pkg: device-flow steps, repository files and manual signing sets for embedding programs

[Interlap01]

A program with its own UI (the MobAI desktop app's signing step) could not reuse the GitHub login, read or write builder.json without a checkout, or take a user's own certificate and profiles the way builder signing setup --certificate --profile does. This exposes those three pieces through pkg/.

Library

• auth: RequestDeviceCode and PollForToken, the two halves of Login, exported. The token comes back unstored so the caller keeps it in its own secret store.
• github: ListRepositories (pushed first, every page), ListBranches, GetFile and PutFile through the contents API, with ErrFileNotFound so "no builder.json yet" is distinguishable from a failure.
• signing: SetupOptions.SaveConfig lets the caller persist builder.json itself (through the API, say); nil keeps writing it in the working directory. SetupManual, ManualType and MatchExtensionProfiles are the manual half of signing setup, moved out of the CLI. BuildP12 is exported for a caller that holds a key and a certificate.

CLI

No behavior change. signing setup keeps its prompts and output; the manual path now calls SetupManual for its upload, profile and save steps, in the same order, and matchExtensionProfiles / manualSigningType delegate under their old names so the existing tests cover the move. Login still prints the code and stores the token as before. Setup and EnsureSecrets save builder.json exactly where they did.

Tests

internal/github/contents_test.go (pagination and query of the repo listing, base64 decoding and the 404 sentinel of GetFile, request body and path escaping of PutFile) and internal/signing/manual_test.go (upload and SaveConfig capture, failed upload still writes the profile, failed save, the nil-SaveConfig default, type and extension matching). Full suite passes with -race; gofmt and vet clean.