Add shared get-github-token.sh for all agents

Single script at repo root that auto-detects GITHUB_APP_ID_* and
GITHUB_PEM_PATH_* env vars, generates a JWT, and exchanges it for a
GitHub App installation token. Contains no secrets.

Updated all heartbeats to reference the absolute path.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

engineering/gandalf/HEARTBEAT.md

@@ -6,7 +6,7 @@ Do these steps in order. Do not skip any. Do not ask for input.
 
 ### 0. Authenticate with GitHub
 
-    export GH_TOKEN=$(bash ./get-github-token.sh)
+    export GH_TOKEN=$(bash /paperclip/privilegedescalation/get-github-token.sh)
 
 ### 1. Load your operating context
 

engineering/hugh/HEARTBEAT.md

@@ -6,7 +6,7 @@ Do these steps in order. Do not skip any. Do not ask for input.
 
 ### 0. Authenticate with GitHub
 
-    export GH_TOKEN=$(bash ./get-github-token.sh)
+    export GH_TOKEN=$(bash /paperclip/privilegedescalation/get-github-token.sh)
 
 ### 1. Load your operating context
 

engineering/regina/HEARTBEAT.md

@@ -6,7 +6,7 @@ Do these steps in order. Do not skip any. Do not ask for input.
 
 ### 0. Authenticate with GitHub
 
-    export GH_TOKEN=$(bash ./get-github-token.sh)
+    export GH_TOKEN=$(bash /paperclip/privilegedescalation/get-github-token.sh)
 
 ### 1. Load your operating context