[FEATURE]: Support private GitHub repos in opencode.json instructions remote URLs

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Problem

The instructions field in opencode.json supports remote URLs, but only does an unauthenticated HTTP GET. Private repos — where most organizations keep their shared coding guidelines — return 404, making this feature useless for internal knowledge bases. See current, public only, documentation: Referencing External Files

Proposal

When instructions contains a github.com URL (including raw.githubusercontent.com), OpenCode should authenticate automatically by resolving a token from a transparent fallback chain:

1. GITHUB_TOKEN env var — already set in shell profile (.zshrc, .bashrc) or CI
2. .env file at project root — for project-level secrets
3. ~/.config/gh/hosts.yml — auto-detect from the GitHub CLI (gh auth login)

No configuration change needed. Auth is transparent — the token is resolved at fetch time and sent as Authorization: Bearer. The instructions field stays as string[], fully backward compatible.

How it works:

• If GITHUB_TOKEN is set in your environment → it works immediately, zero config
• If not → drop a .env file with GITHUB_TOKEN=ghp_xxx at the project root
• If neither → gh auth login once, and the token is extracted from ~/.config/gh/hosts.yml
• If all sources are empty → OpenCode logs a warning and fetches without auth (URL returns 404)

Scope

• Only attach Authorization header to github.com URLs (prevents token leakage to arbitrary domains)
• .env file missing → no error, continue to next source
• ~/.config/gh/hosts.yml missing → no error, continue to next source
• All sources empty → log warning, fetch without auth
• No caching — each request resolves fresh (add only if performance becomes an issue)
• No per-instruction config — auth is transparent, no config type change
• No new npm packages — inline parsers, no dependencies
• No gh CLI dependency — read its config file directly with regex
• No token in logs — warnings say "no token found for URL", not the token value
• Cross-platform: os.homedir() resolves on macOS, Linux, Windows

Architecture

graph TD
    A["fetch"] --> B["resolveToken"]
    B --> C["Env.get(GITHUB_TOKEN)"]
    B --> D["parseEnvFile(cwd)"]
    B --> E["parseGhConfig()"]
    C --> F{"token found?"}
    D --> F
    E --> F
    F -->|yes| G["fetch with Authorization header"]
    F -->|no| H["fetch without auth"]

Why Matters

Organizations that maintain internal coding standards in private GitHub repos can't use the instructions field to keep agents aligned. Every team member currently has to clone the repo locally and manage {file:} paths, or rely on manual AGENTS.md instructions telling the agent to self-fetch via MCP. Neither scales. With this change, one gh auth login (or one env var) and you're done.

@kitlangton please let me know if this is a viable feature, any additional feedback, and if I can take a pass at submitting a PR for this.