Add failing tests for issue #466: OAuth all-repo access

[prompt-driven-github]

Summary

Adds failing tests that detect the bug reported in #466 where PDD CLI requests access to ALL repositories instead of allowing selective repository access.

Test Files

• Unit test: tests/test_get_jwt_token.py
• E2E test: tests/test_e2e_issue_466_oauth_all_repo_scope.py

What This PR Contains

• Unit tests that verify the OAuth scope "repo,user" is hardcoded at pdd/get_jwt_token.py:251
• E2E tests that verify the complete authentication flow uses OAuth Apps which fundamentally cannot support selective repository access
• Tests are verified to document the current buggy behavior

Root Cause

PDD CLI uses GitHub OAuth Apps with the repo,user scope, which by architectural design grants access to ALL repositories. This is a fundamental limitation of GitHub OAuth Apps that cannot be worked around by changing scopes. The repo OAuth scope always means "all repositories the user can access" - there is no OAuth scope that provides selective repository access.

Location: pdd/get_jwt_token.py:251 - The DeviceFlow class hardcodes scope = "repo,user"

Solution Required: Migrate from OAuth App to GitHub App for CLI authentication, which would allow users to install the app and select specific repositories during installation.

Test Behavior

These are regression tests that document the current buggy behavior:

• Unit tests verify the hardcoded OAuth scope configuration
• E2E tests verify the authentication flow behavior at the system level
• After implementing the fix (migrating to GitHub Apps), these tests will need to be updated to verify the new selective access functionality

Next Steps

1. Implement the fix by migrating from OAuth App to GitHub App authentication
2. Update the tests to verify selective repository access works
3. Verify both unit and E2E tests pass with the fix
4. Run full test suite to check for regressions
5. Mark PR as ready for review

Fixes #466

---

Generated by PDD agentic bug workflow - Step 10