feat(github): connect-repo installs the App from a terminal when the repo's account lacks it

[tonychang04]

Why

Tested on prod today: with a linked GitHub identity but no App installation granted to the org, insta compute connect-repo tonychang04/insta-monorepo-demo web stops at the InstaCloud GitHub App reaches none of your repositories — install it on the account that owns this one (console → …). The device flow (#207) authorizes the terminal; nothing lets it get past the install. GitHub has no API that installs an App, so the terminal prints GitHub's install page and afterwards claims what the person installed, proved by the identity it already linked.

What

findCallerRepo, after the caller-scoped listing has no hit for the repo:

1. POST /orgs/{org}/github/installations/claim with { accountLogin: <repo owner> } (insta-platform #428).
2. { installation } → list again once and connect. Still absent → acme/app is not one the App's installation on acme can reach — grant the App access to it on GitHub (Settings → Applications → InstaCloud → Repository access), or pass --public ….
3. { installUrl } → with a reader (a terminal, or agent mode), prints to stderr:

   the InstaCloud GitHub App is not installed on acme — install it once:
     open https://github.com/apps/insta-cloud/installations/new
     (pick the account acme and include app in the repositories it can reach)
   waiting for the installation… (ctrl-c to abort)
   

   then polls the claim every 5s for up to ten minutes (429 / dropped link back off like the device flow; a real error ends it), then lists again. Without a reader (--json, bare pipe) it fails with the URL in the message instead of waiting.
4. { installations } (several accounts, none matching) → names them and says to install on the owner.
5. 400 "not linked" on the claim → device flow once, then claim again. 404 (backend without the route) → today's two console messages, unchanged.

connect-repo's description mentions the install step. No new flags.

Companions

• insta-platform, the claim route this codes against: https://github.com/InsForge/insta-platform/pull/428 (merge first; without it this PR keeps today's messages)
• instacloud-console, the setup page a terminal-started install lands on: https://github.com/InsForge/instacloud-console/pull/435
• instacloud-skills, the CLI reference row: docs(cli): connect-repo authorizes and installs the App from a terminal instacloud-skills#89 (land with or after this)

Follow-ups

• services add compute "Next" hint only mentions insta deploy, not connect-repo — not in this PR.

Tests

test/github-connect.test.ts (+13, 52 pass): claim lands → re-list; partial list still claims; granted-but-excluded message; no-reader message carries the URL; terminal prints the URL, polls ([5, 5]), resolves; 429 + TypeError back off ([5, 10, 15]); a 403 poll ends with that reason; ten-minute timeout; 404 keeps both old messages; not-linked → authorize once, claim twice; not-linked without a reader; choices; empty answer. The two pre-existing "console" message tests now fake a 404 on the claim, which is the backend they describe.

npm run build clean; npm test 918 passed. test/github-source.integration.test.ts fails to load on my machine only because the local git predates git init --initial-branch (its 8 tests are skipped anyway; unrelated).

🤖 Generated with Claude Code

https://claude.ai/code/session_01GvKBDKEyErsLvNdqErtVoR

[tonychang04]

On hold, do not merge (Tony, 2026-09-11). We are going the Railway route instead: the GitHub App's Setup URL moves to a platform backend callback that claims the installation server-side and redirects to the console, so no parked browser session and no CLI device dance is needed. Kept as a draft for reference; the claim route in instacloud-platform #428 may still be useful for the already-installed case.