refactor: move core internals into workspace package

[jlitola]

Summary

• move transport-neutral API clients, PKCE helpers, request/header/telemetry utilities, and related tests into private @githits/core-internal
• keep CLI-local auth storage, keychain, browser, prompt, update-check, and storage-backed token manager code in the root CLI layer
• configure root Bunup build to bundle private workspace source while externalizing runtime dependencies and preventing private markers in published artifacts

Verification

• bun install --frozen-lockfile
• bun run typecheck
• bun test
• bun run lint
• bun run format:check
• git diff --check
• bun run build
• npm pack --dry-run
• bun run smoke:mcp
• bun run smoke:cli
• dist private-marker scan for @githits/core-internal, @githits/mcp, core-internal, and workspace:
• stale root import scan for moved service/shared/auth paths
• code-reviewer pass: no findings