audit(orb): verify brokered Orb mode end-to-end (token broker, webhook relay, outcomes, homepage stats)

[JSONbored]

Priority: P2. Child of #1029.

Verify the central gittensory-orb brokered mode is fully functional from the self-host: the token broker (createInstallationToken→fetchBrokeredInstallationToken), the webhook relay (selfhost_orb_relay_register + the trycloudflare tunnel delivery), the outcomes reporting back to the Orb, and the homepage global stats. Note the trycloudflare PUBLIC_API_ORIGIN is EPHEMERAL — flag whether a stable tunnel/domain is needed so the relay target doesn't go stale on restart. Deliverables: confirm each leg works; recommend a stable ingress.

[JSONbored]

Status (workflow w8yndovp5): token broker + outcomes WORKING; webhook relay BROKEN. Token broker mints live (installationId 142475427); outcomes land in cloud orb_pr_outcomes. But the registered relay_url is an ephemeral trycloudflare tunnel that is DOWN (curl 000) — PUBLIC_API_ORIGIN in the deploy .env is that stale URL, re-registered on every boot. Cloud orb_relay_failures = 975 and growing. The engine survives ONLY via the independent ~2min pull re-gate sweep, so reviews are unaffected, but the push path is dead and the cloud queue grows. FIX = a STABLE public ingress (named Cloudflare Tunnel / dedicated hostname) — best done with the VPS migration (a stable host). Until then the sweep covers reviews.

[JSONbored]

Closing as not planned (2026-07-01 issue audit): Brokered central-Orb path (token broker, webhook relay, homepage stats) retired by pivot; residual stable-ingress belongs to #1660.