Multi-tenant productization (hosted App = primary)

[JSONbored]

Part of #983.

Context

The hosted multi-tenant App is the PRIMARY productization target. gittensory's multi-tenant schema already EXISTS — installations, repositories, repositorySettings, repositoryAiKeys (BYOK), installationHealth — plus a large services/ surface (operator-dashboard, control-panel-roles, maintainer-quality-dashboard), the packages/gittensory-mcp package, and apps/ (gittensory-ui, gittensory-extension). So this is WIRING reviewbot's per-agent config/secrets/audit into that existing per-installation isolation, NOT greenfield. The key adversarial check is cross-tenant leakage: reviewbot's REVIEW_CONFIG/audit are per-agent-slug; in a hosted App they must be per-INSTALLATION, isolated, with no private-rubric or audit bleed across tenants.

Deliverables

• Build the GitHub-App install/onboarding flow on the existing installations/repositories schema.
• Per-installation isolation of config, secrets, and audit (no cross-tenant bleed of private rubric or audit rows).
• Per-repo settings UI on control-panel-roles/operator-dashboard; expose the public .gittensory.yml-equivalent settings, keep the private rubric private (Per-operator private-config seam (runtime rubric/guardrails/params) #1018).
• BYOK key storage via repositoryAiKeys; advisory-only, never blocking.
• Surface the gittensory-mcp package + the workboard/badge/stats dashboard apps for tenants.
• Add a cross-tenant isolation test: tenant A cannot read tenant B's private config or audit.

Acceptance criteria

• A new operator can install the App and onboard a repo through the UI without a deploy.
• Config/secrets/audit are isolated per installation; the cross-tenant isolation test passes (no private-config or audit bleed).
• BYOK keys are stored per-installation and used advisory-only.

Notes

• Milestone: M2
• Depends on: Shadow-parity + per-repo cutover (single-writer, rollback dry-run hard gate) #1027
• Builds on gittensory's existing installations/repositories/repositorySettings/repositoryAiKeys schema — wiring, not greenfield. For HOSTED, agent configs must live in a runtime store (not the compiled registry) so a tenant onboards without a deploy.