Add GitHub API client with configurable base URL and GHE support,
HTTP helpers with 429 retry and Retry-After handling.
Also adds Patch field to vcs.ChangedFile.

Part 1 of 3 for #80.

@@ -0,0 +227,4 @@
+				case <-timer.C:
+					timer.Stop() // no-op after fire; kept for symmetry with the ctx.Done case
+				case <-ctx.Done():
+					timer.Stop()

@@ -0,0 +248,4 @@
+			req.Header.Set("Accept", accept)
+		} else {
+			req.Header.Set("Accept", "application/vnd.github+json")
+		}

@@ -0,0 +255,4 @@
+			return nil, fmt.Errorf("do request: %w", err)
+		}
+
+		body, done, err := c.handleResponse(resp, maxResponseBytes, maxErrorBodyBytes)

@@ -0,0 +176,4 @@
+	err2 := &APIError{StatusCode: 500, Body: "server error"}
+	if IsNotFound(err2) {
+		t.Error("expected IsNotFound to return false for 500")
+	}

@@ -0,0 +192,4 @@
+	if strings.Contains(msg, "\n") || strings.Contains(msg, "\r") {
+		t.Errorf("expected newlines to be sanitized, got: %q", msg)
+	}
+	if !strings.Contains(msg, "line1 injected more") {

@@ -0,0 +200,4 @@
+	} else {
+		backoff = []time.Duration{1 * time.Second, 2 * time.Second}
+	}
+	if len(backoff) != maxAttempts-1 {

@@ -0,0 +261,4 @@
+			return nil, fmt.Errorf("do request: %w", err)
+		}
+
+		// Capture response metadata before handleResponse takes body ownership.

@@ -0,0 +113,4 @@
+func defaultCheckRedirect(req *http.Request, via []*http.Request) error {
+	if len(via) >= 10 {
+		return fmt.Errorf("stopped after 10 redirects")
+	}

@@ -0,0 +194,4 @@
+	// Length must be maxAttempts-1 (one entry per retry gap). Panic early on misconfiguration
+	// so a maxAttempts change without a matching backoff update is caught in tests, not production.
+	var backoff []time.Duration
+	if c.retryBackoff != nil {

@@ -0,0 +245,4 @@
+		}
+		if c.token != "" {
+			// Bearer is the OAuth2 standard and is accepted by GitHub for both
+			// classic PATs and fine-grained tokens. The alternative "token" scheme

@@ -0,0 +295,4 @@
+					if attempt < len(backoff) {
+						backoff[attempt] = delay
+					}
+				}

@@ -0,0 +164,4 @@
+		t.Fatal("expected error for 401")
+	}
+	if attempts != 1 {
+		t.Errorf("expected 1 attempt (no retry on 401), got %d", attempts)

@@ -0,0 +72,4 @@
+		return target, true
+	}
+	return nil, false
+}

@@ -0,0 +149,4 @@
+		baseURL:           strings.TrimRight(baseURL, "/"),
+		allowInsecureHTTP: cfg.allowInsecureHTTP,
+		token:             token,
+		httpClient: &http.Client{

@@ -0,0 +163,4 @@
+// Passing nil restores the default client (30s timeout + auth-stripping
+// CheckRedirect policy matching NewClient).
+//
+// Callers providing a non-nil client are responsible for configuring a safe

@@ -0,0 +191,4 @@
+	const maxRetryAfter = 120 * time.Second
+
+	// backoff holds per-attempt delays: backoff[i] is the delay before attempt i+1.
+	// Length must be maxAttempts-1 (one entry per retry gap). Panic early on misconfiguration

@@ -0,0 +274,4 @@
+		// Retry on 429 rate limit
+		if respStatus == http.StatusTooManyRequests && attempt < maxAttempts-1 {
+			// Check for Retry-After header and override backoff if present.
+			// Supports both integer seconds (common) and HTTP-date format (RFC 7231).

@@ -0,0 +201,4 @@
+		backoff = []time.Duration{1 * time.Second, 2 * time.Second}
+	}
+	if len(backoff) != maxAttempts-1 {
+		panic(fmt.Sprintf("github: backoff length %d does not match maxAttempts-1 (%d)", len(backoff), maxAttempts-1))

@@ -0,0 +90,4 @@
+// This should only be used for trusted internal deployments or testing.
+func AllowInsecureHTTP() ClientOption {
+	return func(c *clientConfig) {
+		c.allowInsecureHTTP = true

@@ -0,0 +117,4 @@
+func defaultCheckRedirect(req *http.Request, via []*http.Request) error {
+	if len(via) >= 10 {
+		return fmt.Errorf("stopped after 10 redirects")
+	}

@@ -0,0 +197,4 @@
+// Transport errors (network failures, context cancellation) are not retried.
+func (c *Client) doRequest(ctx context.Context, method, reqURL string, accept string) ([]byte, error) {
+	const maxRetryAfter = 120 * time.Second
+

@@ -0,0 +268,4 @@
+			return nil, fmt.Errorf("do request: %w", err)
+		}
+
+		// Capture response metadata before handleResponse takes body ownership.

@@ -0,0 +486,4 @@
+	prev := &http.Request{URL: &url.URL{Scheme: "https", Host: "api.github.com", Path: "/foo"}}
+	req := &http.Request{
+		URL:    &url.URL{Scheme: "https", Host: "api.github.com", Path: "/bar"},
+		Header: http.Header{"Authorization": []string{"Bearer token"}},

@@ -0,0 +217,4 @@
+	const maxErrorBodyBytes = 4 * 1024
+
+	// Reject non-HTTPS URLs early since the URL is immutable across retries.
+	if c.token != "" && !c.allowInsecureHTTP {

@@ -0,0 +223,4 @@
+			return nil, fmt.Errorf("parse request URL: %w", err)
+		}
+		if !strings.EqualFold(parsed.Scheme, "https") {
+			return nil, fmt.Errorf("refusing to send credentials over non-HTTPS URL %q (use AllowInsecureHTTP option for trusted networks)", reqURL)