Remove Bearer prefix from safe-inputs authorization headers

pkg/workflow/mcp_renderer.go

@@ -278,7 +278,7 @@ func (r *MCPConfigRendererUnified) renderSafeInputsTOML(yaml *strings.Builder, s
 	}
 
 	yaml.WriteString("          url = \"http://" + host + ":$GH_AW_SAFE_INPUTS_PORT\"\n")
-	yaml.WriteString("          headers = { Authorization = \"Bearer $GH_AW_SAFE_INPUTS_API_KEY\" }\n")
+	yaml.WriteString("          headers = { Authorization = \"$GH_AW_SAFE_INPUTS_API_KEY\" }\n")
 	// Note: env_vars is not supported for HTTP transport in MCP configuration
 	// Environment variables are passed via the workflow job's env: section instead
 }

pkg/workflow/safe_inputs_http_codex_test.go

@@ -79,7 +79,7 @@ Test safe-inputs HTTP transport for Codex
 		t.Error("Expected HTTP URL config with host.docker.internal not found in TOML format")
 	}
 
-	if !strings.Contains(yamlStr, `headers = { Authorization = "Bearer $GH_AW_SAFE_INPUTS_API_KEY" }`) {
+	if !strings.Contains(yamlStr, `headers = { Authorization = "$GH_AW_SAFE_INPUTS_API_KEY" }`) {
 		t.Error("Expected HTTP headers config not found in TOML format")
 	}
 

pkg/workflow/safe_inputs_renderer.go

@@ -86,10 +86,10 @@ func renderSafeInputsMCPConfigWithOptions(yaml *strings.Builder, safeInputs *Saf
 	yaml.WriteString("                \"headers\": {\n")
 	if includeCopilotFields {
 		// Copilot format: backslash-escaped shell variable reference
-		yaml.WriteString("                  \"Authorization\": \"Bearer \\${GH_AW_SAFE_INPUTS_API_KEY}\"\n")
+		yaml.WriteString("                  \"Authorization\": \"\\${GH_AW_SAFE_INPUTS_API_KEY}\"\n")
 	} else {
 		// Claude/Custom format: direct shell variable reference
-		yaml.WriteString("                  \"Authorization\": \"Bearer $GH_AW_SAFE_INPUTS_API_KEY\"\n")
+		yaml.WriteString("                  \"Authorization\": \"$GH_AW_SAFE_INPUTS_API_KEY\"\n")
 	}
 	// Close headers - no trailing comma since this is the last field
 	// Note: env block is NOT included for HTTP servers because the old MCP Gateway schema