fix(gemini): correctly load github token for mcp server

- Switched to github-mcp-server binary instead of npx, since Node.js was removed in commit 58490c36fe
- Added wrapper script for github-mcp-server binary as a workaround
- Updated GitHub PAT key in secrets

home/modules/cli/gemini.nix

@@ -1,5 +1,12 @@
 { pkgs, config, ... }:
 
+let
+  # HACK: Gemini CLI did not read settings.json or .env, so export vars in a wrapper script
+  wrapped-github-mcp-server = pkgs.writeShellScriptBin "github-mcp-server" ''
+    export GITHUB_PERSONAL_ACCESS_TOKEN=$(cat ${config.sops.secrets.github_token.path})
+    exec ${pkgs.github-mcp-server}/bin/github-mcp-server "$@"
+  '';
+in
 {
   sops.secrets.github_token = { };
   home.packages = with pkgs; [
@@ -13,9 +20,9 @@
           "httpUrl": "https://mcp.context7.com/mcp"
         },
         "github": {
-          "command": "npx",
+          "command": "${wrapped-github-mcp-server}/bin/github-mcp-server",
           "args": [
-            "@modelcontextprotocol/server-github"
+            "stdio"
           ],
           "timeout": 10000,
           "trust": false
@@ -24,7 +31,4 @@
       "preferredEditor": "neovim"
     }
   '';
-  home.file.".gemini/.env".text = ''
-    GITHUB_TOKEN=$(cat ${config.sops.secrets.github_token.path})
-  '';
 }