grim7/12/2026, 9:35:18 PM

Live bring-up: a direct install from GitHub's UI carries no `state`, so the
Setup URL callback refused to link (user_installations stayed empty and
/onboarding kept showing the install prompt though repos synced).

- completeInstallation now links on the signed-in session; a PRESENT state must
  still HMAC-match (CSRF), but its absence no longer blocks the happy path. the
  (forge, installationId) UNIQUE still prevents claiming someone else's install.
- __root gate funnels any signed-in request carrying ?installation_id into
  /onboarding/setup WITH its params (some installs land on /setup), so the
  onboarding redirect can't strip them before the callback runs.

Checks: typecheck, biome, boundaries, 204 tests.

Parent70e2899