Fixes #9789

Description

gh auth login --with-token reads a token from standard input until the input ends. A file or a pipe ends on its own, but a terminal does not. The login command never checked where standard input came from. So in a terminal without a piped token, it printed nothing and waited for Ctrl+D. It looked like it had hung. A token pasted while it waited also stayed visible on screen.

Following the acceptance criteria in the issue, --with-token now fails right away when standard input is a terminal. The new check runs before anything reads standard input:

if tokenStdin {
	// New: fail before io.ReadAll waits on a terminal
	if opts.IO.IsStdinTTY() {
		return cmdutil.FlagErrorf("`--with-token` must be used non-interactively, ...")
	}
	defer opts.IO.In.Close()
	token, err := io.ReadAll(opts.IO.In)
	// ...
}

The error shows the redirect form. It also points to interactive gh auth login, which already accepts a pasted token without showing it on screen:

`--with-token` must be used non-interactively, for example `gh auth login --with-token < mytoken.txt`
To paste a token interactively, run `gh auth login` instead.

How did you test this change?

I built gh from trunk at d6b82b1 and from this branch at 2de1e08. I recorded each build running gh auth login --with-token in a terminal. Both runs used an empty config directory and no token environment variables.

Before, the command printed nothing and waited until I pressed Ctrl+C.

After, the command printed the new error and the usage right away. It exited with status 1.

I also ran these by hand in a terminal with an empty config directory:

• gh auth login --with-token --hostname example.com printed the same error and exited with status 1.
• gh auth login --with-token | cat printed the same error. Only stdout was piped, so standard input was still the terminal.
• gh auth login --web --with-token still reported the --web conflict first.
• Piping and redirecting a fake token behaved the same on both builds. Each read the token and failed validation with HTTP 401: Bad credentials.
• gh auth login --hostname github.com --git-protocol ssh --skip-ssh-key still offered Paste an authentication token, which the new hint points to.

Key points

• This changes behavior for anyone who pasted a token and pressed Ctrl+D. The issue thread accepted that, since --with-token is meant for non-interactive input.
• The check looks at standard input only, not CanPrompt(). The wait happens whenever standard input is a terminal, even when stdout is piped or prompts are disabled.
• It returns a flag error, like other commands that refuse to read a terminal, such as gh gist create. That is why the usage follows the error.
• I did not add a hidden token prompt to --with-token. The issue thread preferred an error over prompting in this flag, and interactive gh auth login already covers pasting a token.

Notes for reviewers

• Start with the new check. Then read the tty, with-token and tty, with-token, hostname cases in the constructor test. They now expect the error.
• gh auth login --with-token: provide clear, non-echoing token input when stdin is a terminal #14597 was closed as a duplicate of gh auth login --with-token hangs #9789. It describes the visible token problem in more detail.

Authorship and follow-up

Who wrote this:

• A human wrote it.
• An agent wrote it under close human direction.
• An agent wrote it independently, and no human has guided the implementation beyond the initial prompt.

Who answers review comments:

• @BagToad will read and reply directly.
• An agent will draft replies and @username will read them before they are posted.
• Nobody has explicitly committed to replying.