Managed Agents github_repository rejects documented fine-grained PAT after session creation

### Environment

- Product: Claude Managed Agents (CMA), beta `managed-agents-2026-04-01`
- Resource: `github_repository`
- Repository: private GitHub repository
- Credential: repository-scoped fine-grained GitHub PAT
- Documented permission: `Contents: Read and write`
- Cloud environment with `github.com` and `api.github.com` allow-listed

### Symptom

A session created with a `github_repository` resource accepts the resource and reaches `session.status_running`, but the repository mount never appears. Roughly 10–20 seconds later, the event stream emits:

```
session.error
error.type: unknown_error
error.retry_status.type: exhausted
error.message: GitHub refused access to the repository. If it is private, add an authorization_token with read access to the github_repository resource; if you already did, check that the URL and token are valid.
```

The session then becomes idle. An agent command against the documented mount path fails with `No such file or directory`.

### What was verified

- The exact PAT supplied as `authorization_token` succeeds against `GET /repos/{owner}/{repo}` immediately before session creation.
- GitHub reports `pull: true` and `push: true` for that credential.
- The token is scoped to exactly the target repository and has `Contents: Read and write` as documented for fine-grained PATs.
- The repository URL is exactly `https://github.com/{owner}/{repo}`. The default branch is `main`.
- The CMA environment and agent are active.
- Both `github.com` and `api.github.com` are allowed by the environment.
- Reproduced with default checkout and explicit `{ "type": "branch", "name": "main" }` checkout.
- Reproduced across multiple fresh sessions/resources after credential configuration was refreshed, ruling out a single stale session.
- A disposable probe with a fresh resource confirmed the mount directory was never created.
- `.git` suffix was also tested only as a cache-key diagnostic; CMA correctly rejected it synchronously as an invalid URL, so the normal no-suffix URL is being used.

Disposable sanitized reproduction session for Anthropic engineers:

- Session: `sesn_01MGK2EZQRbzjRjspE98wNCa`
- Resource: `sesrsc_01UoCVBz2BJERrq8bxGDqdSZ`
- Created: 2026-09-11T21:48:56Z
- Archived after evidence capture: 2026-09-11T21:49:54Z

Two additional reproductions:

- `sesn_01Bkq96Cp2H9DtxXhSEDHqr6`
- `sesn_01SKxTxNNyiNfkBBGZEohG2d`

### Expected behavior

The repository should mount successfully because the Managed Agents documentation explicitly supports fine-grained PATs with `Contents: Read and write` for clone/push.

### Questions

1. Did the git proxy receive the fine-grained PAT for the sessions above, or a non-substituted credential placeholder?
2. Does the current `github_repository` mount implementation support `github_pat_*` credentials as documented?
3. Is there another required fine-grained repository permission not listed in the Managed Agents resource documentation?

No credential values, placeholders, request headers, or private repository contents are included in this report.

Start at the Managed Agents github_repository resource and session-creation path, then trace git proxy authentication using the sanitized session IDs in the report. Verify whether the fine-grained PAT reaches the proxy and whether the repository mount is created; done means a private repository mounts successfully with the documented token and checkout modes.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.