Include GitHub App installation in connection setup

[RayTCosgrove]

Summary

GitHub App authorization can succeed without installing the app, leaving private repositories inaccessible. Include installation and repository selection in the built-in GitHub connection flow: open a setup page, configure access on GitHub, then continue account authorization.

The shared OAuth start path returns this page for web, MCP, and reconnect flows. It keeps the original provider URL, PKCE challenge, and organization state in the existing expiring session. The setup endpoint resolves that session under the caller's ownership policy and ignores caller-supplied continuation URLs. The standalone HTML follows the existing callback renderer, with readable markup/CSS and a shared escaping helper.

The installation link defaults to Executor.sh and can be overridden with FIRST_PARTY_GITHUB_INSTALLATION_URL for another deployment's app. It opens in a separate tab, so this flow works without configuring GitHub's optional setup callback. Existing installations can continue directly. The page guides setup; it does not verify installation or organization approval.

GitHub documents installation and user authorization as separate grants.

Verification

• bun run format:check
• bun run lint
• bun run typecheck — 45 packages passed.
• Full repository test gate — all 39 package tasks passed, including 946 SDK tests.
• Focused OAuth, setup rendering, and cloud routing/configuration tests — 85 passed.
• Cloud e2e scenarios/first-party-oauth.test.ts — 2 passed, including GitHub setup includes installation before authorization.
• After the markup cleanup, reran setup/callback rendering tests and the GitHub browser scenario; all passed. GitHub CI completed with no failed checks at 93e334e5e.

The recording shows desktop and mobile layouts in both themes, the installation/authorization actions, and recovery after cancellation. The e2e also checks the actual installation destination, retained authorization parameters, no classic GitHub OAuth scopes, and rejection of a supplied continuation URL. Tests stop at the GitHub boundary; no real app installation was performed.

Checklist

• Added a changeset.
• Added or updated tests for the new behavior.
• No secrets, credentials, or private data in the diff.