GitHub auth: org namespace permission not granted despite public membership + OAuth restrictions removed

Summary

GitHub device-flow login consistently grants only the personal namespace (io.github.<user>/*) and never the organization namespace (io.github.<org>/*), even after satisfying the documented requirements.

Environment

• mcp-publisher: latest release binary (Windows amd64, downloaded 2026-08-19)
• Auth: mcp-publisher login github (device flow)
• User: yusufcemres — owner of org sololabstr
• Target name: io.github.sololabstr/uisight

Steps taken (in order, re-logging-in after each change)

1. Initial publish → 403: "You have permission to publish: io.github.yusufcemres/"* with the hint about public org membership.
2. Made org membership public — verified externally: GET https://api.github.com/orgs/sololabstr/public_members/yusufcemres returns 204.
3. Fresh login github + publish → same 403, permission list unchanged.
4. Removed the org's third-party OAuth application access restrictions entirely (Settings → Third-party application access policy → "Remove restrictions").
5. Fresh login github + publish → same 403, permission list still only io.github.yusufcemres/*.

Expected

After public membership (and especially after removing OAuth app restrictions), a fresh login should include io.github.sololabstr/* in the permission set for an org owner.

Actual

Permission set never includes the org namespace. Worked around by publishing as io.github.yusufcemres/uisight (would love to migrate to the org namespace once this is resolved).

Happy to provide timestamps or retry with a debug build.

Start at the mcp-publisher login github device-flow entry point and follow the permission check used during publish. Compare how public membership and OAuth restrictions are evaluated with the GitHub API response for sololabstr. Done means a fresh login grants io.github.sololabstr/* when the documented organization conditions are met.