fix(cli): Make org identity canonical and forward-compatible

[thecodedrift]

Treats the Taskless organization UUID as the single canonical identity and makes the CLI forward-compatible with the server's coming identity cleanup — without changing any observable behavior today.

What & why

The whoami/token payload currently carries three org identifiers with no clear hierarchy: a Taskless UUID (id), a numeric GitHub org id (orgId), and a GitHub App installationId. This PR establishes id as the one identity we act on and contains the other two.

• Stop consuming installationId. Dropped from the WhoamiOrg type and from the taskless rule meta --json output. It was already .optional() and documented as absent for public repos, so no consumer could rely on its presence. The CLI never used it and it shouldn't round-trip through us.
• Namespace the GitHub org id. WhoamiOrg.orgId is now optional and a new githubOrgId?: number is added; consumers read githubOrgId ?? orgId and keep working across the server's rename. It's a convenience id, never an identity.
• Identify on the canonical id. decodeOrgId prefers the token's id claim over the legacy numeric orgId, and PostHog now groups organizations on that canonical id.
• Tolerate number | string on the legacy path only. The canonical WhoamiOrg.id stays a UUID string; decodeOrgId accepts either type since we can't promise what a legacy claim carries.

No behavior change today

Current tokens don't carry an id claim, so decodeOrgId falls back to the numeric orgId and PostHog grouping is byte-for-byte unchanged until the server starts minting id. The new path is dormant plumbing.

Assumption to confirm

The canonical JWT claim is assumed to be named id (matching the whoami field). It's safe either way — dormant until such a claim exists — but if the server will name it differently, that's a one-word change in decodeOrgId.

Versioning

Marked patch (0.10.2): no observable change now, and the only external surface touched is an already-optional --json field. Bump to minor if you'd rather flag the field removal more loudly.

367 tests pass; typecheck, eslint, prettier clean.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR makes the CLI treat the Taskless organization UUID as the canonical org identity and prepares the client for upcoming server-side org identity cleanup (while aiming to keep current behavior unchanged until tokens start carrying the new claim).

Changes:

• Update JWT org-subject decoding to prefer a canonical id claim (with legacy orgId fallback) and update telemetry grouping to use that canonical subject.
• Adjust the WhoamiOrg type to drop installationId and to be forward-compatible with a server rename from orgId → githubOrgId.
• Remove installationId from taskless rule meta --json output schema and update/add tests plus a changeset entry.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/cli/test/telemetry.test.ts	Adds coverage ensuring telemetry groups by canonical id when present.
packages/cli/test/org.test.ts	Updates whoami org fixtures to align with the new WhoamiOrg shape.
packages/cli/test/jwt.test.ts	Expands decodeOrgId tests for canonical-claim precedence and new accepted types.
packages/cli/src/telemetry.ts	Switches PostHog org grouping from legacy orgId to canonical org subject.
packages/cli/src/schemas/rules-meta.ts	Drops installationId from the meta JSON output schema.
packages/cli/src/auth/org.ts	Refines WhoamiOrg typing for forward-compat (githubOrgId ?? orgId) and removes installationId.
packages/cli/src/auth/jwt.ts	Changes decodeOrgId to prefer the canonical id claim and return `string
.changeset/org-identity-forward-compat.md	Documents the forward-compat identity changes as a patch release.