chore(orb): verify brokered self-host relay and telemetry

[JSONbored]

Parent: #1819

Context

Brokered Orb mode lets a self-hosted engine use the central Orb token broker and webhook relay instead of requiring every operator to manage a full GitHub App key path. The runtime also exports anonymized outcome telemetry for fleet calibration.

This path needs an end-to-end operational audit before the self-host stack is presented as officially ready.

Requirements

• Verify token broker flow for installation token minting, caching, expiry, refresh, and broker outage behavior.
• Verify webhook relay behavior in push and pull modes, including registration, drain, ack, retry, and stale-event handling.
• Investigate and document expected handling for relay registration failures, especially when pull mode still drains events.
• Verify outcome export behavior, anonymization defaults, air-gap mode, retry behavior, and failure visibility.
• Confirm stable ingress requirements for operators who choose push relay mode.
• Ensure logs/Sentry context identify relay/token/export failures without exposing tokens, enrollment secrets, raw webhook bodies, private repo config, or unhashed private identifiers when anonymization is enabled.

Deliverables

• End-to-end audit notes for brokered token, webhook relay, and outcome export paths.
• Reproducible smoke checklist for both pull-mode and push-mode relay where practical.
• Clear recommendation for stable ingress versus pull-mode default for NAT/tailnet deployments.
• Any focused fixes needed for relay registration/degraded telemetry behavior.
• Website docs updates for GitHub App and Orb setup/troubleshooting.

Acceptance criteria

• A brokered self-host can receive PR events, process reviews, publish GitHub output, and export outcome telemetry.
• Relay failures are visible and actionable without falsely implying the engine is healthy when no events can arrive.
• Pull-mode degraded registration does not page incorrectly when event draining is still functioning.
• Air-gapped deployments can disable outbound outcome export intentionally.

Validation

• Brokered token smoke test.
• Relay drain/register smoke test.
• Outcome export smoke or controlled test with expected anonymization.
• Relevant unit tests for failure classification if code changes are needed.

Ownership

Maintainer-only. No gittensor:* labels.

[JSONbored]

Concrete symptom for this issue's verification scope: queried production D1 directly (orb_signals and orb_instances tables) and both are completely empty (0 rows), despite src/selfhost/orb-collector.ts's own code comments describing the anonymized fleet-telemetry export as "ALWAYS ON once the GitHub App is configured (the fleet-telemetry contract of self-hosting) — there is no opt-out flag" (unless ORB_AIR_GAP=true).

This means exportOrbBatch() → POST /v1/orb/ingest → orb_signals/orb_instances has never successfully delivered a single event in production, for any self-hosted instance including JSONbored's own — the pipeline this issue is meant to verify appears to be non-functional end-to-end, not just unverified. Worth prioritizing as the concrete blocker: per #1939, this is also the mechanism the public homepage counters are meant to eventually read from ("Orb telemetry remains available in direct App mode so website counters and aggregate outcome data still work"), so it's on the critical path for more than just gate calibration.

(For context: the homepage counter itself has been fixed separately in #2643, using the older orb_pr_outcomes/audit_events sources that already had real data — this comment is specifically about the newer orb_signals always-on export path remaining broken.)