Validate Han CLI is permanently red on main: coverage badge gist token returns 401 #116

Validate Han CLI has failed on every push to main going back to at least 2026-07-19. The tests, typecheck and lint steps pass; the job dies on its last step:

validate  Update coverage badge  Run schneegans/dynamic-badges-action@v1.7.0
validate  Update coverage badge    gistID: cd6f81e193544d779245496680af7ba0
validate  Update coverage badge    filename: han-coverage.json
validate  Update coverage badge    message: 18.7%
validate  Update coverage badge  ##[error]Failed to get gist: 401 Unauthorized

Recent Validate Han CLI runs on main, all red for the same reason:

2026-09-08T05:40 failure 9c654557f
2026-08-25T03:14 failure 6529db3be
2026-08-25T03:14 failure 86e63c919
2026-08-12T16:28 failure b13c116b1
2026-08-12T14:35 failure 3aa22bd63
2026-08-12T11:07 failure a7a02ccce
2026-08-12T09:21 failure 3405f3403
2026-07-19T21:56 failure 4ae9e3277

401 on GET /gists/<id> means the token the action authenticates with is invalid, expired, or no longer carries the gist scope. It only runs on pushes to main, so PR checks stay green and the breakage is invisible until someone reads a main run.

Two ways out, both one change:

• Mint a fresh classic PAT with only the gist scope, and update the repository secret the workflow passes as auth.
• Drop the badge step and read coverage from Codecov, which already reports on every PR.

Worth deciding rather than leaving it, because a permanently red required-looking job on main trains everyone to ignore that signal.