feat(FN-1236): migrate GitHub PR workflows to gh authentication

- Require gh-authenticated paths for task pr-create and dashboard PR routes
- Switch dashboard command and extension GitHub tools to use the gh auth client instead of token-based auth
- Update CLI and dashboard tests to cover gh-only createPr and import behavior
- Refresh README guidance and add a changeset removing the GitHub token requirement for PR flows

packages/dashboard/README.md

@@ -429,7 +429,7 @@ When the merge strategy is **Pull request**:
 - Required checks must pass before kb merges the PR; optional checks do not block auto-merge
 - A blocking review state (for example, active changes requested) prevents auto-merge until cleared
 - Closed PRs do not auto-merge
-- GitHub access must be available via `gh auth login` or `GITHUB_TOKEN`
+- GitHub access for PR-first workflows must be available via `gh auth login`
 - kb expects the task branch to already be pushed using the standard branch name `kb/<task-id-lower>`
 
 **Non-goal:** the dashboard does not implicitly push branches before PR creation. Use your normal git workflow or automation to publish task branches first.

packages/dashboard/src/github.test.ts

@@ -75,10 +75,11 @@ describe("GitHubClient", () => {
       base: "main",
     };
 
-    it("creates PR using gh CLI when available", async () => {
+    it("createPr succeeds with gh CLI only (no token)", async () => {
       mockRunGh.mockReturnValue("https://github.com/test-owner/test-repo/pull/42\n");
+      const ghOnlyClient = new GitHubClient();
 
-      const result = await client.createPr(mockPrParams);
+      const result = await ghOnlyClient.createPr(mockPrParams);
 
       expect(mockRunGh).toHaveBeenCalledWith([
         "pr", "create",
@@ -181,12 +182,12 @@ describe("GitHubClient", () => {
       vi.restoreAllMocks();
     });
 
-    it("throws error when gh CLI fails and no token available", async () => {
+    it("throws gh-auth-focused error when gh CLI fails and no token is available", async () => {
       mockRunGh.mockImplementation(() => {
-        throw new Error("gh command failed: not authenticated");
+        throw new Error("GitHub CLI is not authenticated. Run 'gh auth login'.");
       });
 
-      await expect(client.createPr(mockPrParams)).rejects.toThrow();
+      await expect(client.createPr(mockPrParams)).rejects.toThrow("gh auth login");
     });
   });
 

packages/dashboard/src/routes.ts

@@ -4255,7 +4255,7 @@ export function createApiRoutes(store: TaskStore, options?: ServerOptions): Rout
       }
 
       // Create the PR
-      const client = new GitHubClient(githubToken);
+      const client = new GitHubClient();
 
       const prInfo = await client.createPr({
         owner,
@@ -4543,7 +4543,7 @@ export function createApiRoutes(store: TaskStore, options?: ServerOptions): Rout
       }
 
       // Fetch fresh PR status + merge readiness
-      const client = new GitHubClient(githubToken);
+      const client = new GitHubClient();
       const mergeStatus = await client.getPrMergeStatus(owner, repo, task.prInfo.number);
 
       const prInfo = {