[the1mills]

Stacked on #123's exact package-reader head; once #123 lands, this diff collapses to the edge-capability slice.

This salvages conflict-blocked #122 without rebasing and updates its dependency contract to current zed-interfaces main b6ec4ad9926b9c8b36ce9a5eb9814f5ea56e8126 rather than restoring the stale pin. That revision contains the same V2 edge-fallback contract blob.

Security boundaries:

• only private package visibility is eligible; public fallback stays anonymous and unknown visibilities fail closed;
• requires existing org or project membership before capability construction;
• confines GitHub grants to canonical repository-owned resources and opaque credential references (no upstream secret in the capability);
• caps V2 capability lifetime to the interface maximum and binds sub, sid, and parent_jti;
• projects the authenticated DEN-2859: salvage delegated CLI package-reader boundary #123 PackageReaderIdentity directly into the edge principal so revocation lineage is not dropped;
• this remains capability construction/ACL logic, not yet route wiring for all digest endpoints in Private registry packages with org-scoped reader authorization #101.

[linear-code]

DEN-2859

[ORESoftware]

Semantic conflict review against current main per ORESoftware/my-ai: this stale branch's intended revocable private GitHub edge-capability ACL has landed as the stronger current-main successor #126, commit 698232b0dba700b6d1bbc8518cdb9b5cf816abf2, after parent package-reader #123 merged. The landed implementation preserves the same V2 capability contract, private-only eligibility, membership gate, canonical GitHub resource confinement, opaque github-app:repo:* credential references, sub/sid/parent_jti lineage, and bounded lifetime, while also advancing package/interface provenance and release state on the current dependency graph. Current main also includes the downstream private artifact authorization from #125. Replaying #124 would reintroduce stale package/dependency/lock state rather than add unique semantics. Closing as superseded by #126 instead of choosing conflict sides.