Restore handler test coverage for the token-rotation path

## Context

PR #62 skipped `lambdas › token-rotator › completes without error` (`apps/token-rotator/src/main.spec.ts`) because it is a live-API test wired to a dead fixture: the committed `.env.test` authenticated as GitHub App `217830` in the third-party `skedrocket` org, which no longer exists — the GitHub API returns **"Integration not found"** unconditionally, so the test failed 100% of the time on every branch (verified on Renovate branches predating that PR).

That skip leaves the **entire GitHub-auth → registration-token → SSM-put path with zero test coverage** (the only other specs are `guard.spec.ts` and `stringHelpers.spec.ts`; `libs/github` has none). No *working* coverage was lost, but this must not become permanent.

## Restoration options

1. **Hermetic (preferred)**: mock the GitHub API (e.g. `nock`) so the handler test runs without live credentials — deterministic, no secrets.
2. **Live**: recreate a dedicated test App under the cloudposse org and inject its ID/key via repo secrets (never a committed file).

## Hygiene follow-up

`.env.test` committed the dead App's private key at the repo root; PR #62 replaces it with placeholders, but the key remains in **git history** — inert (the App is deleted), but worth removing per policy if history-rewrites are ever done.

Refs: #62