gh auth status can report an invalid hosts.yml token when the real problem is blocked GitHub API connectivity in Codex or another sandbox. The release command and review bot now probe gh api user before asking for re-auth, continue when that probe succeeds, and report network/sandbox failure when the API is unreachable.

Constraint: Old gh auth status output can conflate API connectivity failure with invalid stored credentials

Rejected: Always tell users to run gh auth login | repeats a false fix when the token is valid but api.github.com is unreachable

Confidence: high

Scope-risk: narrow

Directive: Do not collapse GitHub auth failures back to one re-auth message without preserving API-connectivity diagnostics

Tested: bash -n scripts/review-bot-watch.sh

Tested: bash -n templates/scripts/review-bot-watch.sh

Tested: node --test test/release.test.js

Tested: node --test test/agents.test.js

Co-authored-by: OmX <omx@oh-my-codex.dev>