bug(github-pat): stale per-agent PAT copy not refreshed on global rotation (deferred from #1979) + github-sync.md flow drift

[vybe]

Two follow-ups from #1979 (fix for #1967):

1. Deferred case: an agent whose per-agent PAT row holds a stale copy of the old global PAT is deliberately skipped by propagation (skipped_per_agent_pat) — correct for genuinely distinct per-agent tokens, but a stale copy of the rotated global PAT stays broken until manually cleared. The PR calls this 'worth its own issue'.
2. Doc drift: docs/memory/feature-flows/github-sync.md §Global PAT Auto-Propagation (feat: Auto-propagate GitHub PAT to all agents on update #211) still documents the old eligibility rule ('.env must already contain a GITHUB_PAT key') and the old response shape (no remote_updated/remotes_updated).

Refs #1979, #1967.