fix(github): gracefully handle GitHub App agent assignment 403

[sentry]

Summary

This PR addresses issue GITTENSORY-1G by modifying ensurePullRequestAssignee to gracefully handle attempts to assign bot accounts using GitHub App installation tokens. Previously, such attempts resulted in an HttpError (403) because GitHub's API explicitly disallows assigning agents with installation tokens. The fix now catches this specific HttpError (status 403 with the message "Assigning agents is not supported") and returns { applied: false } instead of re-throwing. This allows the calling performAction in agent-action-executor.ts to correctly trigger its existing fallback mechanism, which creates a by:{login} label when an assignee cannot be applied.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Closes GITTENSORY-1G

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Required for visible UI, frontend, docs, or extension changes. Attach GitHub-hosted JPG/JPEG or PNG screenshots here; SVG screenshots are not accepted as review evidence. Use a compact table/grid of clickable thumbnails with a short state/title such as "Loaded state", "Empty state", "Error state", "Mobile layout", or "PR sidebar". Prefer annotated screenshots with a colored box, outline, arrow, or highlighter showing what changed. Recordings can be supplemental, but screenshots are still expected for visual review. Do not commit review-only screenshots, recordings, or docs/review-evidence/** files.

State / title	JPG/PNG evidence
Loaded state	<a href="FULL_URL.png"><img src="FULL_URL.png" alt="Loaded state" width="240"></a>
Empty/error/mobile state, if relevant

Notes

Fixes GITTENSORY-1G

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 33.33333% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.72%. Comparing base (ab95b4c) to head (9313085).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/github/assignees.ts	33.33%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4167      +/-   ##
==========================================
- Coverage   93.73%   93.72%   -0.02%     
==========================================
  Files         387      387              
  Lines       36304    36309       +5     
  Branches    13298    13300       +2     
==========================================
+ Hits        34031    34032       +1     
- Misses       1617     1621       +4     
  Partials      656      656              

Files with missing lines	Coverage Δ
src/github/assignees.ts	81.81% <33.33%> (-18.19%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Gittensory is closing this pull request on the maintainer's behalf (CI is failing (codecov/patch); No linked issue detected; Maintainer requires a linked issue). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.