fix(github): resume installation permission upgrades

[realmroot]

Outcome

GitHub App permission increases now target the exact installation instead of the new-install account selector. The Adapter keeps the original authorization intent on a waiting page, observes the signed new_permissions_accepted webhook, and resumes the same Realmroot approval automatically.

The permission-review URL is derived from the canonical installation html_url, so personal and organization installations use their correct GitHub settings paths.

Review-environment acceptance

1. Deploy this PR to adapters.realmroot.dev with an existing personal or organization GitHub App installation.
2. Add a repository permission to the GitHub App that the installation has not accepted.
3. Request its mapped scope for that installation Context from realmroot agent request.
4. On the Realmroot Agent resource access page, choose Update permissions and authorize the matching GitHub user.
5. Confirm the Adapter waiting page opens the exact installation permission-review page, not the App installation account selector.
6. Accept the new permission in GitHub. Confirm the GitHub window closes and the original Realmroot approval becomes authorizable without starting a second request.
7. Authorize it and run a real realmroot exec github --context <context> -- gh api ... operation requiring that permission.
8. Repeat the request and confirm an already accepted permission skips the GitHub update step.

Verification

• pnpm run docs:check
• pnpm run typecheck
• pnpm run lint
• pnpm run test:unit (161 tests)
• pnpm run test:integration (15 tests)
• pnpm run build
• Live personal installation saltbo (152267965): permission update, automatic transaction resume, Agent authorization, and provider API reachability passed.
• Live organization installation realmroot (152329382): canonical organization permission URL, automatic transaction resume, and GET /repos/realmroot/adapters/rulesets returned 200.

---

_{🤖 Created by Jarvis via Realmroot}