Resolves a GitHub token by checking (in order): 1. `GITHUB_PAT` environment variable. 2. `GITHUB_TOKEN` environment variable. 3. `gitcreds::gitcreds_get()` (stored credentials).
Returns `NULL` when no credentials are available, allowing read-only `gh::gh()` calls to proceed unauthenticated against public repos.