[loop-cycle-5] fix: get_token() priority order — config before repo-root fallback (#899)

tests/timmy_automations/test_health_snapshot.py

@@ -60,8 +60,17 @@ class TestGetToken:
 
         assert token == "file-token-456"
 
-    def test_returns_none_when_no_token(self):
+    def test_returns_none_when_no_token(self, monkeypatch):
         """Return None when no token available."""
+        # Prevent repo-root .timmy_gitea_token fallback from leaking real token
+        _orig_exists = Path.exists
+
+        def _exists_no_timmy(self):
+            if self.name == ".timmy_gitea_token":
+                return False
+            return _orig_exists(self)
+
+        monkeypatch.setattr(Path, "exists", _exists_no_timmy)
         config = {"token_file": "/nonexistent/path"}
         token = hs.get_token(config)