Return the GitHub credential state every surface renders from.

configured means a command run now would carry a credential: a live App grant or a fine-grained token. A pre-rule gho_/ghp_ value reads as not configured, which is what makes the clone dialog show its connect affordances again instead of attempting an authenticated clone the sandbox will never receive. The app block carries what Settings needs to offer the one-click path, or to say the deployment has none.