feat(orb): installation registry from Orb App install events

[JSONbored]

Summary

Second piece of the central Gittensory Orb GitHub App (#1255). Maintains a new orb_github_installations registry (migration 0064) from the verified /v1/orb/webhook installation lifecycle events — one row per install of the shared Orb App: account, repository_selection, and the suspend / unsuspend / deleted lifecycle. This is the registry that onboarding (PR #5) and the token-broker (PR #6) read to know which installations exist and who owns them.

• registered=0 by default — the Mirror-style manual-onboarding gate (an install is recorded but not trusted/active until a human opts it in), mirroring feat(orb): registration-gate the fleet + cap ingest body (das-github-mirror model) #1274's orb_instances trust model.
• The upsert runs synchronously in the receiver, before recording the webhook event, so a failed registry write is flipped to "error" + 500 and GitHub redelivers (the dedup guard only suppresses non-error rows). No-op for every non-installation event.

⚠️ Stacked on #1293 (the webhook receiver) — base is feat/orb-webhook-receiver, not main. Merge #1293 first, then this rebases onto main cleanly.

installation_repositories repo-delta tracking and PR-outcome processing are follow-ups (#7).

Scope

• Additive; migration 0064 is the next contiguous number; flag-independent (only fires on verified Orb webhooks)

Validation

• npm run test:ci — green
• 100% branch coverage on src/orb/installations.ts + the webhook.ts changes (all install actions: created / new_permissions_accepted / suspend / unsuspend / deleted / unknown; non-installation event; missing/zero installation id; minimal-payload null fields; and the upsert-failure → 500 + error-row path)

Advances #1255.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.09%. Comparing base (2f6f189) to head (ae8ce9e).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                    Coverage Diff                     @@
##           feat/orb-webhook-receiver    #1295   +/-   ##
==========================================================
  Coverage                      95.09%   95.09%           
==========================================================
  Files                            179      180    +1     
  Lines                          20092    20111   +19     
  Branches                        7228     7232    +4     
==========================================================
+ Hits                           19106    19125   +19     
  Misses                           395      395           
  Partials                         591      591           

Files with missing lines	Coverage Δ
src/orb/installations.ts	100.00% <100.00%> (ø)
src/orb/webhook.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.