fix(orb): OAuth self-enrollment has no fail-safe around GitHub network calls

[JSONbored]

⚠️ Definition of Done: this issue must be completed in full, in a single PR. Do not split this
work across multiple PRs, and do not defer any Deliverable below to a follow-up issue. A PR that
satisfies only some of the Deliverables, stubs a required test, or leaves a checkbox
partially-done does NOT resolve this issue and will be closed.

Context

src/orb/oauth.ts:70-96's handleOrbEnrollment and its three network calls -- exchangeOrbOAuthCode (25-34), fetchOrbOAuthUser (37-43), verifyInstallationAdmin (49-68) -- handle every non-OK/malformed response cleanly (e.g. returning a 400 landing page for "Couldn't verify your GitHub identity"), but none of the three calls is wrapped in try/catch, and none uses this codebase's own timeout-fetch failure-doesn't-throw convention seen in webhook.ts/relay.ts/ingest.ts. A thrown network error (DNS failure, timeout past timeoutFetch's own retry budget) escapes handleOrbOAuthCallback as an uncaught exception instead of the function's own clean error page. test/integration/orb-oauth.test.ts only exercises non-OK responses, never a rejected fetchImpl promise, for any of the three calls.

Requirements

Wrap the three network calls (or the whole handleOrbEnrollment body) so a thrown fetch error degrades to the existing "Couldn't verify your GitHub identity" landing page instead of escaping as a raw framework error.

Deliverables

• A thrown error from any of the three GitHub network calls in handleOrbEnrollment degrades to the existing clean error landing page, not an uncaught exception
• A test for each of the three calls in test/integration/orb-oauth.test.ts exercising a rejected fetchImpl promise, asserting the clean error page is returned

All of the above Deliverables are required in the same PR unless the deliverable text itself states otherwise.

Test Coverage Requirements

src/** -- 99%+ patch coverage, branch-counted, on all three new catch paths.

Expected Outcome

A thrown network error during OAuth self-enrollment degrades to the same clean error page the module already produces for a bad HTTP response, instead of an uncaught exception.

Links & Resources

• src/orb/oauth.ts:25-34,37-43,49-68,70-96
• test/integration/orb-oauth.test.ts

[linear-code]

JSO-6160