test: remove secrets from PR integration tests - #484

What does this do?

Removes repository-secret requirements from the GitHub init and plugin Leia tests so they can run for fork pull requests.

• preserves the deploy key for trusted branches and generates an ephemeral key for fork PR jobs
• allows the GitHub init source to clone explicit public HTTPS repositories without creating or uploading an SSH key
• rewrites the init-github Leia test to use a public HTTPS clone without mutating a real GitHub account
• replaces the GitHub Packages plugin fixture with an authenticated, disposable Verdaccio registry
• restores init-github and plugins coverage for fork PRs
• removes the privileged GitHub PAT from the workflow

The l337 and lando-v4 suites continue to be skipped on forks because they intentionally verify authenticated SSH cloning. Trusted branches retain that coverage with the deploy key.

SSH GitHub initialization remains unchanged and is covered alongside the new HTTPS behavior by unit tests.

Testing

• full unit suite
• full lint suite
• GitHub source unit tests
• Verdaccio account creation, package publish, lookup, and npm-profile login flow
• workflow and Verdaccio YAML parsing
• git diff --check

The exact Docker-backed Verdaccio Leia flow is left to CI because Docker is not installed in the local execution environment.