A transport fix that still went through the broken transport

The helper exists because gh dies in the sandbox: its TLS path needs Mach IPC to securityd and returns OSStatus -26276. It replaces the transport with a plain fetch. Then it acquired its token by running gh auth token, which is the same binary, and on macOS may consult the login keychain, the same securityd dependency. The header called that read "keychain-free". It is not.

transport   gh https  broken   ->  fetch  fixed
token       gh auth token         ->  gh auth token  still gh

Secondary finding: the script had zero call sites. Nothing imported it, because importing it ran a process.exit() at module top level and killed the importing process.

Token precedence, before and after

Why the import bug mattered more than the token bug

A script nothing can call is a script nothing can test. Both defects have the same shape: a module that exits at import time cannot be a library, so the token path had no coverage and the false claim in its header had nothing to contradict it. Making it importable is what let the seven tests exist at all, and what let check-workflow-gates.sh fall back to it when gh api dies.

top of module   if (NODE_USE_ENV_PROXY !== '1') { ...; process.exit() }  on import
bottom          main().catch(... process.exit(1))                     on import

both now gated on isEntryPoint                                        importable