Self-hoster branding: gittensoryFooter + repo-doc-render honor PUBLIC_SITE_ORIGIN

[JSONbored]

Context

Part of the review-stack architecture audit (parent epic — hardcoding dimension). Two related findings,
same root cause: public-facing, self-hoster-visible output hardcodes JSONbored's own domain instead of
the deployment's configured PUBLIC_SITE_ORIGIN.

Finding 1 — the PR-comment footer on every reviewed PR

src/github/footer.ts:43-60 (gittensoryFooter):

export const GITTENSORY_SITE_URL = "https://gittensory.aethereal.dev";
...
export function gittensoryFooter(opts: {...} = {}): string {
  ...
  `Checked by [Gittensory](${GITTENSORY_SITE_URL}), a quiet PR intelligence layer for OSS maintainers.`
}

This footer is appended to every single reviewed PR comment across the whole engine — dozens of call
sites (src/signals/engine.ts:4395,4491, src/github/commands.ts:410, src/review/planner.ts:173,
src/review/e2e-test-gen-render.ts:59,71,97, src/queue/processors.ts ×10+). None of them pass env,
and gittensoryFooter takes no env/site-origin param at all.

The bug is the inconsistency: the sibling function in the same file, maintainerControlPanelUrl
(footer.ts:17-18), does this correctly — env.PUBLIC_SITE_ORIGIN ?? GITTENSORY_SITE_URL. A self-hoster
who sets PUBLIC_SITE_ORIGIN gets their own domain in the control-panel link, but the public-facing
footer on every reviewed PR still says "Checked by Gittensory" linking to gittensory.aethereal.dev —
attributing every reviewed PR on the self-hoster's own repos to JSONbored's product instead of their own
deployment.

Finding 2 — generated AGENTS.md content

src/review/repo-doc-render.ts:78 — generated AGENTS.md content permanently hardcodes:

This file is generated by [Gittensory](https://gittensory.aethereal.dev) from a profile of this repository's own

renderRepoDocContent(profile: RepoProfile) is documented as "Pure and deterministic: no GitHub calls,
no AI" and takes no env parameter by design (so the diff-aware refresh in generated-doc-refresh.ts
can byte-compare output). This function's output gets committed into a self-hoster's own repository
(via src/github/repo-doc-pr.ts) as their own AGENTS.md — always saying "generated by Gittensory"
linking to JSONbored's domain, unconfigurable.

Fix

• Thread env: { PUBLIC_SITE_ORIGIN?: string } into gittensoryFooter (and its caller-side helper
  footerEarnUrl), using env.PUBLIC_SITE_ORIGIN ?? GITTENSORY_SITE_URL — same pattern as
  maintainerControlPanelUrl.
• For repo-doc-render.ts: either accept a siteUrl parameter (resolved by the caller from
  PUBLIC_SITE_ORIGIN, preserving purity/determinism — the same profile still renders identically for a
  given input) or make the line static plain text with no link, so per-deployment branding doesn't leak
  into the generated-content purity guarantee.

Acceptance criteria

• A self-hoster with PUBLIC_SITE_ORIGIN set sees their own domain in the PR footer and generated
  AGENTS.md, not gittensory.aethereal.dev.
• Default behavior for deployments without PUBLIC_SITE_ORIGIN set is unchanged.
• renderRepoDocContent's purity/determinism guarantee is preserved (same input → same output).

[linear-code]

JSO-3395