fix(selfhost): require contents permission for auto-merge

[JSONbored]

Summary

• Require contents: write for auto-merge paths and keep pull_requests: write scoped to PR review, close, and update-branch actions.
• Carry GitHub installation token permission snapshots through the Orb broker and refresh broker tokens on permission-scope 403s.
• Persist refreshed broker permissions locally and surface merge-specific remediation in installation health and settings preview diagnostics.

What changed

• Split agent action permission requirements by action class.
• Added a broker token force-refresh flow for stale permission scopes.
• Updated brokered installation health to use permission snapshots when GitHub provides them while keeping event introspection honest.
• Added regression coverage for merge permission denial, broker permission refresh, and permission diagnostics.
• Fixed two small engine issues surfaced by the full coverage gate: an export syntax break and stale handling for absent opportunity timestamps.

Why

GitHub merge calls require contents: write. Treating auto-merge as a pull_requests: write action let correctly re-approved installations still fail at runtime, especially when brokered self-hosts reused stale cached tokens or stale local permission snapshots.

Validation

• git diff --check
• npm run typecheck
• npm audit --audit-level=moderate
• npm run test:coverage

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	7b1b99b	Commit Preview URL Branch Preview URL	Jul 04 2026, 12:09 AM

[codecov]

Codecov Report

❌ Patch coverage is 87.85047% with 13 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@755499d). Learn more about missing BASE report.
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/github/backfill.ts	84.21%	1 Missing and 5 partials ⚠️
src/settings/agent-execution.ts	90.47%	0 Missing and 2 partials ⚠️
src/api/routes.ts	66.66%	0 Missing and 1 partial ⚠️
src/db/repositories.ts	66.66%	0 Missing and 1 partial ⚠️
src/github/app.ts	92.85%	1 Missing ⚠️
src/orb/broker.ts	85.71%	0 Missing and 1 partial ⚠️
src/signals/settings-preview.ts	88.88%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2858   +/-   ##
=======================================
  Coverage        ?   96.00%           
=======================================
  Files           ?      258           
  Lines           ?    28251           
  Branches        ?    10275           
=======================================
  Hits            ?    27123           
  Misses          ?      491           
  Partials        ?      637           

Files with missing lines	Coverage Δ
...ges/gittensory-engine/src/opportunity-freshness.ts	100.00% <100.00%> (ø)
src/orb/app-auth.ts	100.00% <100.00%> (ø)
src/orb/broker-client.ts	98.78% <100.00%> (ø)
src/services/agent-action-executor.ts	96.33% <100.00%> (ø)
src/api/routes.ts	94.48% <66.66%> (ø)
src/db/repositories.ts	96.39% <66.66%> (ø)
src/github/app.ts	98.16% <92.85%> (ø)
src/orb/broker.ts	97.72% <85.71%> (ø)
src/signals/settings-preview.ts	98.51% <88.88%> (ø)
src/settings/agent-execution.ts	93.54% <90.47%> (ø)
... and 1 more

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.