githug in GitHub Actions

Use this when an agent runs in a workflow and should push as itself, not as github-actions[bot] or a person.

1. Create the agent at githug.ai/app (or hug agent create my-agent --repo owner/repo). Copy its key.
2. Save it as a repository secret named GITHUG_AGENT_KEY.
3. Add these steps before the agent pushes:

      - name: githug token
        env:
          GITHUG_AGENT_KEY: ${{ secrets.GITHUG_AGENT_KEY }}
        run: |
          curl -fsSL https://githug.ai/install | sh
          eval "$(hug env --repo ${{ github.repository }} --run ${{ github.run_id }})"
          echo "::add-mask::$GH_TOKEN"
          git config user.name "$GIT_AUTHOR_NAME"
          git config user.email "$GIT_AUTHOR_EMAIL"
          git commit -am "Agent changes" -m "$GITHUG_TRAILERS"
          hug attest --repo ${{ github.repository }}
          git push "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" HEAD:agent/${{ github.run_id }}

--run ${{ github.run_id }} ties every key and commit to the workflow run, so the chain on githug.ai/v links back to it. hug attest reports the new commits with the agent's key before the push, which is what makes them show as verified rather than just consistent. Keep the token inside one step: it lasts an hour, and hug env mints a new one each time you call it.