Add role-bound GitHub App execution and candidate reconciliation - #2376

Written-by: Codex

Refs #2365. Target: delivery/ai-centric-development-service.

Opt-in role App bindings let SDK/native Dev commit/push/update the original Draft PR and Reviewer submit an actual exact-SHA Review with a different App. Dedicated short-lived helpers reuse the existing installation provider and worker/claim/resource fences; no Owner fallback or generic Token export. Original candidate Effects adopt the real SDK SHA/PR and reconcile interrupted writeback. Host tests, signed forge PASS, selected host App merge and Chief acceptance remain separate.

Includes memory/dated decision, owned architecture, role conventions, README/operator guide, OpenAPI, generated patches and regression tests. No Control Plane/UI, live task/configuration/credential or deployment changes.

Validation at d0f2b844c01a0fcced4fdbf92f11d36115fee271:

• Full TZ=UTC setpriv --bounding-set=-dac_override,-dac_read_search npm run verify passed: 4,930 tests across all suite groups, including core 3,122 and all 8 actual disposable DSH runtime cases. Node 24 basic CI tests-ok is green at this exact head.
• Actual installed Codex SDK/CLI 0.166: 2 local + 2 Docker cases passed, including real Git author/committer, scoped credential transport and Reviewer filesystem denial. Responses, App credentials and gh results are fixtures.
• OpenAPI 3.1 validation, generated artifacts and targeted Git/provider/IPC/recovery/security regressions passed.
• Loaded-new-file coverage sample: 96.16% lines / 70.78% branches / 88.89% functions; not 100%. Uncovered branches include helper framing, lost-create remote recovery, pagination exhaustion and channel timeout/error; helper entry is not instrumented.

Real GitHub App push/PR/Review/check/merge acceptance is pending explicitly authorized installed Dev/Reviewer Apps and a test repository. Keep #2365 open; do not substitute personal gh activity for App evidence. Installation Tokens are not branch-scoped; existing branch protection/checks still apply.

Pairing self-review covers correctness, security and conventions; no unresolved implementation blockers or independent forge PASS claimed. Merge scope follows the Owner's existing delivery-branch/basic-CI instruction.

Delivery-only gate scope: the Owner previously waived independent signed Review/enqueue checkpoints for this non-main branch. enqueue-guard reports missing Verifier; no PASS is fabricated. Target branch rules query returns no applicable rules, tests-ok is green and PR is mergeable; no admin/rules/check bypass is used.