feat(llm,github): tenant-scoped runtime overrides + GitHub polish

[hoangsnowy]

Change description

Stacked on top of #18. Re-base targets main automatically once #18 merges.

Closes a multi-tenant correctness bug in the LLM gateway and the GitHub integration, then polishes the GitHub PR opener.

The bug

RuntimeOverrides used to be an in-memory singleton populated once at startup by HydrateRuntimeOverridesAsync — running inside whatever DI scope the AppHost happened to spin up first. Whatever tenant that scope resolved to became the source of truth for the entire process. Every subsequent request — regardless of which tenant signed in — read the SAME _overrides.AnthropicApiKey, _overrides.GitHubPat, etc.

In multi-tenant deployments this means tenant A's Anthropic key bills tenant B's pipeline runs, and tenant B's PR opener pushes to tenant A's GitHub repo. Not a hypothetical leak — it's the only behavior the old singleton could produce.

The fix

RuntimeOverrides becomes a thin read / write-through adapter over IAppConfigStore. Every property access creates a per-call DI scope, resolves the current ITenantContext, and reads / writes the matching app_config row. IAppConfigStore's existing 15s per-(tenant, key) cache absorbs the read pressure, so a key-pool factory closure that reads _overrides.AnthropicApiKey on every LLM call only hits the DB once per cache window per tenant.

The IRuntimeOverrides interface keeps its sync getter/setter shape — LlmModule's key-pool factories (registered as Singleton) and GitHubPrService (registered as Transient) don't need to become async. Sync-over-async is bridged inside the impl; ASP.NET Core has no SynchronizationContext, so the bridge is deadlock-safe.

GitHub integration polish

• New GitHubBaseUrl override per tenant → Octokit hits a GHE host instead of public github.com when set. Blank / null → public host.
• Pre-flight missing X, Y, Z message lists every absent config field instead of "PAT and target repo must be set".
• NotFoundException on the base-branch fetch → wrapped as "branch X not found, set GitHubBaseBranch or create it".
• AuthorizationException → wrapped as "PAT rejected, check 'repo' scope and expiry".
• Branch prefix agentic-sdlc/<ts> → agentos/<ts> so operators can git push origin --delete agentos/* to clean up.

Removals

• HydrateRuntimeOverridesAsync (LlmModule no longer implements IInitializableModule)
• SaveRuntimeOverridesAsync (Settings UI writes through the setters)
• File RuntimeOverridesExtensions.cs deleted entirely

Type of change

• Bugfix (multi-tenant isolation)
• Refactor (no observable behavior change in single-tenant mode)

Test plan

• dotnet build Release: 0 warnings, 0 errors
• dotnet test: 226 passed, 5 skipped (live-smoke)
• 8 new tests:
  • 5 tenant-isolation tests on RuntimeOverrides (Tenant A writes, Tenant B reads null; per-tenant GitHub PAT; key-pool round-trips; blank value deletes; no-store falls back to silent no-op)
  • 3 GitHub config branches (missing PAT → message names it, missing owner+name → both listed, blank title → ArgumentException)

Decisions

• Sync interface preserved. Changing IRuntimeOverrides to async would force a cascade through PooledChatLlmClient.SendAsync (the key-pool delegate is sync) and GitHubPrService. Trade-off: a .GetAwaiter().GetResult() lives in the impl. ASP.NET Core has no SynchronizationContext, so this is deadlock-safe; the per-(tenant, key) 15s cache caps DB pressure.
• No cache invalidation event. When the Settings UI writes a new key, the next 15s window of reads still serves the old value. Acceptable for an operator-config surface; documented in code.
• GHE base URL stored per tenant. Different tenants may live on different GHE instances. The current single-tenant install just leaves it blank.

Checklist

• dotnet build passes locally in Release mode
• dotnet test passes
• No secrets committed
• README / docs updated — none required (private-by-default API surface, tests document the new behavior)