Reject public-only tokens for repository migrations and require repository scope for canonical organization repository creation. This aligns both routes with the existing token authorization boundaries. _Assisted-by: Codex:GPT-5_