fix(selfhost): require ORB_WEBHOOK_SECRET for Orb exporter

[JSONbored]

Motivation

• Prevent deterministic anonymization and signing with an empty HMAC key when the Orb exporter runs without a configured secret, which could leak reproducible repo/pr hashes for pending events.
• Fail-closed on missing secret so pending local events are not exported with a public empty key and the operator is signaled via metrics.

Description

• Make exportOrbBatch return early when ORB_WEBHOOK_SECRET is unset and increment the gittensory_orb_export_errors_total metric instead of defaulting to an empty-string key.
• Keep existing anonymization logic and HMAC behavior unchanged when a secret is present.
• Update the unit tests in test/unit/selfhost-orb-collector.test.ts to delete the secret env var and assert the exporter does not call the collector, leaves rows unexported, and records the error metric.
• Replace the previous test that exercised the empty-key branch with a regression test that verifies the fail-closed behavior.

Testing

• npm test -- --run test/unit/selfhost-orb-collector.test.ts passed (21 tests) and verifies the new fail-closed path and other exporter behaviors.
• npm run test:coverage -- --run test/unit/selfhost-orb-collector.test.ts ran but coverage remapping failed in the local environment with TypeError: jsTokens is not a function (tooling issue unrelated to logic changes).
• npm run typecheck failed in this environment due to missing local native deps/types (pg, ioredis) not present in node_modules, which is unrelated to the change.
• npm run test:ci exercised the pipeline until the repo-wide typecheck step and failed for the same missing-dependency type errors; npm audit --audit-level=moderate failed due to the registry audit endpoint returning 403.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.97%. Comparing base (ff0eade) to head (e94fce4).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1246   +/-   ##
=======================================
  Coverage   94.97%   94.97%           
=======================================
  Files         177      177           
  Lines       19806    19809    +3     
  Branches     7125     7125           
=======================================
+ Hits        18811    18814    +3     
  Misses        397      397           
  Partials      598      598           

Files with missing lines	Coverage Δ
src/selfhost/orb-collector.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JSONbored]

Superseded by #1257. This PR requires ORB_WEBHOOK_SECRET for the exporter, but #1257 deliberately moves Orb anonymization off ORB_WEBHOOK_SECRET entirely — it derives a dedicated, domain-separated key from the GitHub App private key (independent of webhook-secret rotation) and no-ops export when no App key is present. So this approach is now directionally obsolete. Closing in favor of #1257 (rebased + green). Reopen if #1257 is dropped.