intercom

Live-validates the access token with one real read (verify_credentials) before anything is persisted -- same discipline routers/zendesk.py's connect_zendesk applies to its own token via verify_credentials, so a typo'd or revoked token fails immediately with a clear error instead of silently saving a connection the nightly sync will only discover is broken hours later. Unlike connect_zendesk, there's no subdomain/agent_email to collect -- Intercom's access token alone identifies the workspace (see gnt/intercom/client.py's module docstring).

Sync-status health surface -- last successful sync, last error, and this run's item/candidate counts. Same role as routers/zendesk.py's own /sync-status endpoint -- a plain GET a future gnt status addition or the web dashboard can poll rather than anything pushed. Returns the same "never synced yet" zero-value shape regardless of whether Intercom is even connected -- callers that care should check GET /v1/settings/intercom's connected field first.