feat(github-app): add installation repair workflow

[JSONbored]

Parent roadmap: #82

Background

GitHub App setup can fail from missing permissions or events. Maintainers need exact repair instructions instead of generic unhealthy status.

Goal

Add a repair workflow that diagnoses missing permissions/events and refreshes installation health after changes.

Current Behavior

Installation health reports exist, but repair is not a structured workflow.

Desired Behavior

Maintainers receive exact settings to update, reinstall/approve steps, and a way to refresh health.

Implementation Requirements

• Add installation repair diagnostics endpoint.
• Include required vs optional permissions/events.
• Explain comment/label/check mode impacts.
• Add health refresh trigger.
• Keep output secret-safe.

Public/Private Output Boundaries

Public GitHub output must stay quiet-by-default and sanitized. It must not include private reviewability, scoreability, reward/risk, raw trust, wallet/hotkey, or public score estimates.

Acceptance Criteria

• Missing Issues write is reported for comment/label mode.
• Checks write is optional unless check mode enabled.
• issue_comment event is diagnosed.
• Health refresh updates status.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally to avoid CI variance.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, queue pressure, source-upload safety, public/private boundaries, or upstream drift.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.
• MCP/local tooling must prove source contents are not uploaded.

Additional Test Scenarios

• Healthy install fixture.
• Missing permission fixture.
• Missing event fixture.
• Optional checks fixture.
• Secret redaction regression.