fix: scope workflow credentials to callers

modules/capabilities/ai.nix

@@ -7,6 +7,18 @@ in
   flake.modules.nixos.ai =
     { pkgs, ... }:
     let
+      context7Headers = pkgs.writeShellScript "context7-http-headers" ''
+        set -euo pipefail
+
+        CONTEXT7_KEY_FILE="''${XDG_CONFIG_HOME:-$HOME/.config}/context7/api-key"
+        [[ -r "$CONTEXT7_KEY_FILE" ]]
+        CONTEXT7_KEY="$(< "$CONTEXT7_KEY_FILE")"
+
+        exec ${pkgs.jq}/bin/jq --null-input --compact-output \
+          --arg authorization "Bearer $CONTEXT7_KEY" \
+          '{ Authorization: $authorization }'
+      '';
+
       codexConfig = (pkgs.formats.toml { }).generate "codex-config.toml" {
         model = "gpt-5.6-sol";
         model_reasoning_effort = "high";
@@ -29,7 +41,7 @@ in
         mcp_servers = {
           context7 = {
             url = "https://mcp.context7.com/mcp";
-            env_http_headers.CONTEXT7_API_KEY = "CONTEXT7_API_KEY";
+            http_headers_helper = "${context7Headers}";
           };
           nixos = {
             command = "${pkgs.uv}/bin/uvx";

modules/capabilities/git.nix

@@ -6,11 +6,24 @@ in
   flake.modules.homeManager.git =
     {
       config,
+      pkgs,
       ...
     }:
     let
       machine = config.facts.machine;
       allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
+      githubTokenFile = "${config.xdg.configHome}/yookr/github-read-only.token";
+
+      gh = pkgs.symlinkJoin {
+        name = "gh-with-read-only-token-${pkgs.gh.version}";
+        paths = [ pkgs.gh ];
+        nativeBuildInputs = [ pkgs.makeWrapper ];
+        meta.mainProgram = "gh";
+        postBuild = ''
+          wrapProgram "$out/bin/gh" \
+            --run 'if [[ -z "''${GH_TOKEN:-}" && -r "${githubTokenFile}" ]]; then export GH_TOKEN="$(< "${githubTokenFile}")"; fi'
+        '';
+      };
 
       mkScope =
         scope:
@@ -46,12 +59,6 @@ in
         personal.allowedSigners ++ work.allowedSigners ++ [ "" ]
       );
 
-      programs.zsh.initContent = ''
-        if [[ -r "${config.xdg.configHome}/yookr/github-read-only.token" ]]; then
-          export GH_TOKEN="$(< "${config.xdg.configHome}/yookr/github-read-only.token")"
-        fi
-      '';
-
       programs.git = {
         enable = true;
         signing.format = "ssh";
@@ -92,6 +99,7 @@ in
 
       programs.gh = {
         enable = true;
+        package = gh;
         settings.git_protocol = "ssh";
       };
     };