refactor!: rename --source-org flag to --app-set in mint enroll

[waynesun09]

Summary

• Renames --source-org to --app-set in mint enroll commands, converging on the same naming convention used by admin install
• Uses appsetup.DefaultAppSet constant and appsetup.ValidateAppSet() validator, matching the admin command path
• Updates tests (including new self-enroll coverage), docs, and SKILL.md runbook scripts

BREAKING CHANGE: --source-org flag removed, use --app-set instead.

Test plan

• make go-test — all tests pass
• make go-vet — clean
• grep -rn 'source.org' internal/cli/mint.go — zero results
• grep -rn 'source-org' internal/cli/ docs/ skills/ — zero results
• ./bin/fullsend mint enroll --help — shows --app-set flag with correct default
• 10-agent review squad — all findings addressed

[github-actions]

Site preview

Preview: https://dd65f996-site.fullsend-ai.workers.dev

Commit: 02cbeb0bbe1f97701d10fc6088ca6238ffe540ab

[fullsend-ai-review]

Review

Findings

High

• [protected-path] skills/mint-enroll/SKILL.md — This PR modifies a file under the skills/ protected path. No linked issue provides authorization for this change. The SKILL.md updates are consistent with the flag rename (updating runbook scripts from SOURCE_ORG to APP_SET), but human approval is required for all protected-path changes and a linked issue should justify the modification.
  Remediation: Link an authorizing issue to this PR that covers the --source-org → --app-set rename, including the SKILL.md runbook updates.

Previous run

Review

Findings

High

• [protected-path] skills/mint-enroll/SKILL.md — This PR modifies a file under the skills/ protected path. No linked issue provides authorization for this change. The SKILL.md updates are consistent with the flag rename (updating runbook scripts from SOURCE_ORG to APP_SET), but human approval is required for all protected-path changes and a linked issue should justify the modification.
  Remediation: Link an authorizing issue to this PR that covers the --source-org → --app-set rename, including the SKILL.md runbook updates.

Previous run

Review

Findings

High

• [protected-path] skills/mint-enroll/SKILL.md — This PR modifies a file under the skills/ protected path. No linked issue provides authorization for this change. The SKILL.md updates are consistent with the flag rename (updating runbook scripts from SOURCE_ORG to APP_SET), but human approval is required for all protected-path changes and a linked issue should justify the modification.
  Remediation: Link an authorizing issue to this PR that covers the --source-org → --app-set rename, including the SKILL.md runbook updates.

Low

• [documentation-currency] docs/guides/admin/installation.md:185 — This line still refers to "the source org" when describing PEM secret copying. The same file already uses --app-set terminology two lines later (line 187), creating an inconsistency. Since the PR renames the concept from "source org" to "app set" across the codebase, this reference is now stale.
  Remediation: Update line 185 to use "app set" terminology (e.g., "It copies PEM secrets from the app set to the new org's scoped key").

Previous run

Review

Findings

High

• [protected-path] skills/mint-enroll/SKILL.md — This PR modifies a file under the skills/ protected path. No linked issue provides authorization for this change. The SKILL.md updates are consistent with the flag rename (updating runbook scripts from SOURCE_ORG to APP_SET), but human approval is required for all protected-path changes and a linked issue should justify the modification.
  Remediation: Link an authorizing issue to this PR that covers the --source-org → --app-set rename, including the SKILL.md runbook updates.

Previous run (2)

Review

Findings

High

• [protected-path] skills/mint-enroll/SKILL.md — This PR modifies a file under the skills/ protected path. No linked issue provides authorization for this change. The SKILL.md updates are consistent with the flag rename (updating runbook scripts from SOURCE_ORG to APP_SET), but human approval is required for all protected-path changes and a linked issue should justify the modification.
  Remediation: Link an authorizing issue to this PR that covers the --source-org → --app-set rename, including the SKILL.md runbook updates.

Low

• [documentation-currency] docs/guides/admin/installation.md:185 — This line still refers to "the source org" when describing PEM secret copying. The same file already uses --app-set terminology two lines later (line 187), creating an inconsistency. Since the PR renames the concept from "source org" to "app set" across the codebase, this reference is now stale.
  Remediation: Update line 185 to use "app set" terminology (e.g., "It copies PEM secrets from the app set to the new org's scoped key").

[fullsend-ai-review]

See the review comment for full details.

[ifireball]

Not sure how neccessray this PR is, I think we need to drop the support for multiple app sets from the mint soon (preferably before I finish the public mint ADRs so I don't have to deal with that extra functionality in them).

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

See the review comment for full details.

[waynesun09]

This is a step toward decoupling from a specific org name — the concept is really an "app set" (a logical grouping of GitHub App installations), not necessarily tied to any particular GitHub org.

That said, this rename is not about stripping out the ability to create app sets or letting users bring their own mint service. It's just a terminology alignment so the flag name reflects what it actually represents.

Agree that simplifying multi-app-set support is a separate conversation worth having before the public mint ADRs land.