fix(submitter): dry runs no longer require credentials

A dry run is a preview: it still passes rate-limit and dedup checks but
must not demand a forge token. Credentials.get has always run before the
dry_run branch (this predates the PR), so dry-run submissions failed with
{:error, :no_credentials} in any credential-less environment — visible for
the first time now that the Test gate actually executes (3 CI failures on
a suite that is green locally only because the sandbox has ambient
GH_TOKEN). Verified 272/272 both with and without GITHUB_TOKEN/GH_TOKEN
in the environment.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017LDhR8gtnittEWSafunnrq

Author: claude

elixir-mcp/lib/feedback_a_tron/submitter.ex

@@ -97,26 +97,29 @@ defmodule FeedbackATron.Submitter do
           platforms
           |> Enum.map(fn platform ->
             with :ok <- RateLimiter.check(platform),
-                 :ok <- maybe_dedupe(dedupe, platform, issue),
-                 {:ok, cred} <- Credentials.get(state.credentials, platform) do
+                 :ok <- maybe_dedupe(dedupe, platform, issue) do
+              # A dry run is a preview: it still passes rate-limit and dedup
+              # checks above, but must not require credentials.
               if dry_run do
                 {:ok, %{platform: platform, status: :dry_run, would_submit: issue}}
               else
-                result = Retry.with_backoff(fn -> do_submit(platform, issue, cred, opts) end)
-
-                # Record only real successes: never dry runs (which
-                # short-circuit above), never errors. Recording feeds the
-                # deduplicator so recurring themes are recognized as recurring.
-                case result do
-                  {:ok, submission_result} ->
-                    RateLimiter.record(platform)
-                    Deduplicator.record(issue, platform, submission_result)
-
-                  _ ->
-                    :ok
+                with {:ok, cred} <- Credentials.get(state.credentials, platform) do
+                  result = Retry.with_backoff(fn -> do_submit(platform, issue, cred, opts) end)
+
+                  # Record only real successes: never dry runs (which
+                  # short-circuit above), never errors. Recording feeds the
+                  # deduplicator so recurring themes are recognized as recurring.
+                  case result do
+                    {:ok, submission_result} ->
+                      RateLimiter.record(platform)
+                      Deduplicator.record(issue, platform, submission_result)
+
+                    _ ->
+                      :ok
+                  end
+
+                  result
                 end
-
-                result
               end
             end
           end)