fix(github): auto-repair missing installation mappings on tool calls

[viktormarinho]

Context

Confirmed via `wrangler kv key list` on the prod `INSTALLATIONS` namespace:

```
[
{ "name": "triggers:conn_0dviUelZu80E9zZSrAa_v" },
{ "name": "triggers:conn_I1KBBnrohC6orbVqXPIcv" }
]
```

Two `triggers:` entries (good — TRIGGER_CONFIGURE populated them) but zero `installation:` entries. Webhook deliveries have been arriving correctly and immediately skipping with `no mapping for installation=120173638` because the first OAuth completed before the User-Agent fix was deployed — `captureInstallationMappings` silently caught the 403 from `GET /user/installations` and never wrote anything.

Fix

• New `InstallationStore.hasAnyForConnection(connectionId)` method — single KV `list({ prefix: 'connection::', limit: 1 })`.
• New `ensureInstallationMappings()` wrapper: no-op if the connection already has mappings, otherwise runs the full capture.
• Injected into `buildUpstreamTools`' execute path in `mcp-proxy.ts` so the next MCP tool call each affected user makes auto-rebuilds their mapping.
• `onChange` in `main.ts` now uses the `ensureInstallationMappings` variant too (same effect for the common path, cheaper for repeat OAuth refreshes).

Test plan

• After merge + deploy, issue a single MCP tool call from an already-connected user. Expect `[Installation] Mapped () → ` in worker logs.
• Re-run `bunx wrangler kv key list --namespace-id c81656fe... --remote` — should now include `installation:` and `connection::` entries.
• Create an issue on a repo where the App is installed. Expect `[Webhook] → delivery=... event=github.issues.opened …` followed by `[Webhook] ✓ delivery=... mesh callback delivered (2xx)`.

🤖 Generated with Claude Code

---

Summary by cubic

Automatically rebuilds missing GitHub installation mappings during MCP tool calls, fixing skipped webhooks for affected users without re-auth. Adds a cheap pre-check and only runs the full capture when needed.

• Bug Fixes
  • Added InstallationStore.hasAnyForConnection(connectionId) using KV list({ prefix: 'connection:<id>:', limit: 1 }).
  • Introduced ensureInstallationMappings(token, connectionId, store) to capture mappings only when absent.
  • Wired into buildUpstreamTools execute in mcp-proxy.ts, and switched main.ts onChange to use it.
  • Addresses cases where captureInstallationMappings previously swallowed 403 from GET /user/installations, leaving no installation:* keys.

^{Written for commit ef6e1c9. Summary will update on new commits.}