Browser auth auto-renewal: validate plist + add preflight check for agent-browser tasks

[FrederikHandberg]

Problem

com.jensen.browser-refresh plist exists but has never been validated end-to-end. Auth files are ~1 day old (recently refreshed manually).

When a job needs X (Twitter) or GitHub auth and the session is expired, it fails with a cryptic error. There's no pre-flight auth check before jobs that use agent-browser.

Fix

1. Validate the plist:

launchctl list | grep browser-refresh
# Check LastExitStatus
# Run manually: launchctl start com.jensen.browser-refresh
# Verify sessions refreshed

2. Add auth preflight to jobs using agent-browser:
In any job that needs browser auth, add at the start:

# Preflight: verify X session is active
if ! check-x-auth.sh; then
  echo 'X auth expired — triggering browser refresh'
  launchctl start com.jensen.browser-refresh
  sleep 30
  check-x-auth.sh || { echo 'Auth refresh failed'; exit 1; }
fi

3. Morning report includes auth status:

• GitHub: gh auth status
• X/Twitter: check cookie age
• Google/gog: gog auth status --account jensen@tutoria.ac

Acceptance Criteria

• com.jensen.browser-refresh validated, LastExitStatus = 0
• Auth preflight script exists at scripts/check-auth.sh
• Jobs requiring browser auth call the preflight
• Morning report includes auth validity for all 3 services
• Auth failure creates GH issue automatically

Context

From Jensen limitation audit (2026-03-22). Workstream: WS-001.