orb(webhook): install health reports 'healthy' without check_run/check_suite, and the setup wizard ships a manifest missing two required events

[JSONbored]

Two related defects in event-subscription handling.

(a) The auto-merge trigger is not a required event. REQUIRED_INSTALLATION_EVENTS = ["issues", "issue_comment", "pull_request", "repository"] (src/github/backfill.ts ~887), and missingEvents is filtered down to that set before the status is upgraded to "healthy" (~954-960).

So an installation not subscribed to check_run/check_suite reports healthy, eventRemediation never mentions them, and ORB silently degrades from event-driven to sweep-only for CI settlement — even though maybeReReviewOnCiCompletion is documented in-code as "THE auto-merge / close-on-red TRIGGER" (src/queue/processors.ts ~4646-4652). Same for pull_request_review, pull_request_review_thread, deployment_status, workflow_run.

(b) The wizard-generated App manifest omits two events that ARE required. src/selfhost/setup-wizard.ts ~62 sets default_events: ["pull_request", "pull_request_review", "push", "issues", "check_suite", "check_run", "status"] — missing issue_comment and repository.

A wizard-created self-host therefore starts with every @loopover … command dead (review / pause / resume / resolve / explain / generate-tests / configuration, processors.ts ~6013-6140) and no rename handling. Health will flag this one — but the wizard shipping a manifest that contradicts its own required-event list is the bug.

Fix

Make REQUIRED_INSTALLATION_EVENTS the single source of truth and derive the wizard's default_events from it. Promote check_run, check_suite, pull_request_review to required; add pull_request_review_thread, deployment_status, workflow_run, status as optional-but-diagnosed.

Acceptance

• An installation missing check_suite reports degraded, with remediation naming the event.
• The wizard manifest is generated from the required list, so the two can never drift.

[linear-code]

JSO-6264