fix(github): classify runtime authorization denial reasons

[pandemicsyn]

Summary

• Adds bounded reporting for actionable GitHub runtime authorization denials at the standard webhook route, the deferred webhook dispatch check, and the bot-session callback: a fixed warning-level message carrying a single bounded reason tag.
• missing_association reporting behavior at those callers is retained unchanged; the exact production cause of those denials remains unproven. Every other rejection reason reports.
• Current main already contains the detailed rejection taxonomy and the prepareReviewPayload diagnostics, so this PR does not change or duplicate them. The only new code is a shared predicate plus the three caller report sites and their tests.
• Diagnostics only: the authorization and ownership decision, the fail-closed behavior, the webhook acknowledgment responses, the deferred-dispatch skip, and the callback terminal outcome and message are unchanged. No installation lifecycle, persistence, schema, or migration change.
• Merged current main into this branch to resolve conflicts before review. Related to KILOCODE-WEB-27W0 only.

Verification

No manual verification was performed. The change is confined to server-side error classification and reporting plus tests; no user-facing or interactive path was exercised in this session.

Visual Changes

N/A

Reviewer Notes

• Strong overlap with open feat(github): share installations with web Cloud Agents  #5978, feat(slack): support shared GitHub Cloud Agent workflows #6089, and fix(github): fix connect/disconnect lifecycle bugs found in live org testing #6100. When integrating, preserve their exact association-ID authorization, canonical lifecycle checks, and shared-tenant routing; port only this PR's boundary reporting and never replace a stack runtime guard with an older authorization model.
• The shared predicate selects the reported reasons and is intentionally bounded. Confirm missing_association retains its existing behavior at these callers while the actionable reasons report; the exact production cause of missing-association denials is not established by this change.
• Confirm the authorization decision, the webhook acknowledgment (200 for authorization denials, 503 only for non-authorization failures), the deferred-dispatch skip, and the callback terminal outcome are unchanged.
• The added tag carries only the bounded reason enum; no identifiers, credentials, raw errors, or request payloads are added.
• Ready against current main after merge resolution. Not verified as composable with the unmerged stack PRs; that integration is a follow-up decision.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (10 files)

• apps/web/src/lib/integrations/github/runtime-authorization.ts
• apps/web/src/lib/integrations/github/runtime-authorization.test.ts
• apps/web/src/app/api/webhooks/github/route.ts
• apps/web/src/app/api/webhooks/github/route.test.ts
• apps/web/src/lib/integrations/platforms/github/webhook-handler.ts
• apps/web/src/lib/integrations/platforms/github/webhook-handler.test.ts
• apps/web/src/app/api/internal/bot-session-callback/[botRequestId]/route.ts
• apps/web/src/app/api/internal/bot-session-callback/[botRequestId]/route.test.ts
• apps/web/src/lib/integrations/db/github-installations.test.ts
• apps/web/src/lib/code-reviews/triggers/prepare-review-payload.test.ts

Statically reviewed isUnexpectedGitHubRuntimeAuthorizationDenial plus its three call-site report blocks and all touched tests. The predicate only adds bounded captureMessage tags (source/endpoint + github_runtime_authorization_reason) and leaves authorization decisions, fail-closed behavior, acknowledgement responses, deferred-dispatch skips, and callback terminal outcomes unchanged; no leaked identifiers or credentials and no listener/timer additions. The ReadonlySet allowlist mirrors existing codebase patterns, so it was not raised. The custom kilocode-landing page rules are N/A to this repository. Test assertions (reason ordering such as integration_status before disconnected, and the ambiguity case) match the current implementation.

---

_{Reviewed by deepseek-v4.1-flash · Input: 0 · Output: 0 · Cached: 0}

_{Review guidance: REVIEW.md from base branch main}