fix(github-app): harden public surface publishing

[JSONbored]

Summary

• Keep PR public-surface outputs independent so a sticky-comment failure does not block the advisory context check or other outputs.
• Preserve installation account, permission, and event metadata when GitHub sends partial installation repository events.
• Require Pull requests: write in installation health for PR public comments/labels, matching live installed-app behavior.
• Add audit records for per-output public-surface failures so production smoke tests do not depend on Worker tail logs.

What changed

• Publishes Gittensory Context before comment/label outputs and records output-level failures.
• Records pr_public_surface_published when at least one configured output succeeds, including published and failed output metadata.
• Preserves existing installation metadata on partial install lifecycle payloads and reuses the preserved actor for product-usage redaction.
• Updates settings/command preview warnings and unit/integration coverage for the stricter PR-write permission model.

Why

Live installed-app smoke testing showed Gittensory Gate worked, but a GitHub comment-write 403 aborted the rest of the public-surface path. The app should keep advisory checks and audit visibility working even when comments or labels need permission repair.

Validation

• npm run test:unit -- test/unit/queue.test.ts
• npx vitest run test/integration/api.test.ts
• npm run test:coverage
• npm run typecheck
• npm run test:smoke:production

Notes

• Deployed the fix branch to production for installed-app smoke testing.
• Current production install health now correctly reports pull_requests as the remaining missing permission.
• Sticky comments and labels still require approving/updating the GitHub App to Pull requests: write.

Fixes #413

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	3e661d8	Commit Preview URL Branch Preview URL	Jun 05 2026, 09:57 AM