fix: scope workflow credentials to callers

modules/capabilities/git.nix

@@ -6,11 +6,24 @@ in
   flake.modules.homeManager.git =
     {
       config,
+      pkgs,
       ...
     }:
     let
       machine = config.facts.machine;
       allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
+      githubTokenFile = "${config.xdg.configHome}/yookr/github-read-only.token";
+
+      gh = pkgs.symlinkJoin {
+        name = "gh-with-read-only-token-${pkgs.gh.version}";
+        paths = [ pkgs.gh ];
+        nativeBuildInputs = [ pkgs.makeWrapper ];
+        meta.mainProgram = "gh";
+        postBuild = ''
+          wrapProgram "$out/bin/gh" \
+            --run 'if [[ -z "''${GH_TOKEN:-}" && -r "${githubTokenFile}" ]]; then export GH_TOKEN="$(< "${githubTokenFile}")"; fi'
+        '';
+      };
 
       mkScope =
         scope:
@@ -46,12 +59,6 @@ in
         personal.allowedSigners ++ work.allowedSigners ++ [ "" ]
       );
 
-      programs.zsh.initContent = ''
-        if [[ -r "${config.xdg.configHome}/yookr/github-read-only.token" ]]; then
-          export GH_TOKEN="$(< "${config.xdg.configHome}/yookr/github-read-only.token")"
-        fi
-      '';
-
       programs.git = {
         enable = true;
         signing.format = "ssh";
@@ -92,6 +99,7 @@ in
 
       programs.gh = {
         enable = true;
+        package = gh;
         settings.git_protocol = "ssh";
       };
     };