Add basectl GitHub auth status and refresh workflow

[codeforester]

Summary

• add basectl gh auth status for safe credential diagnostics
• add basectl gh auth refresh with repeatable scope selection and clipboard support
• detect GH_TOKEN/GITHUB_TOKEN precedence without reading or persisting token values
• distinguish network failures from unavailable login and add Project-scope refresh guidance
• update command reference, workflow docs, and Bash/Zsh completion coverage

Behavior

Stored credentials can be refreshed explicitly with basectl gh auth refresh --scope project. Environment-provided tokens remain outside Base ownership; when present, Base explains that refreshing stored credentials will not change the active token. Ordinary GitHub commands never launch an implicit OAuth flow.

Validation

• full Python suite: 1,018 passed, 1 skipped
• focused auth and completion Bats tests passing
• zsh -n completion validation passing
• ShellCheck warning-level validation passing
• git diff --check passing
• authenticated CLI smoke test for basectl gh auth status passing

Closes #1688