Reconcile the GitHub fork back into canonical #5499

Why

GitHub and gluecron.com were two forked repos, not a mirror. Nothing synced in either direction:

GitHub's 15 were the 2026-07-25 nav/wiring sweep (13 commits, 8 test files, ~1,500 lines) plus the external heartbeat workflow — which exists nowhere else. Archiving GitHub as-is would have silently deleted the only outside-the-box monitor.

This merges GitHub in so it becomes an ancestor, which recovers the stranded work and makes the eventual canonical → GitHub push a fast-forward rather than a force. That's the precondition for the cutover runbook's Phase 4.

How conflicts were resolved

Per hunk, on merit — 26 hunks across 15 files. Canonical had independently re-solved much of the July sweep in better form, so HEAD won there:

• SettingsSubnav was deleted on canonical for the grouped SettingsNav. Every incoming import of it was a dead reference that would not have built.
• admin.tsx derives its grid from ADMIN_NAV, not the literal list July patched.
• RepoNav's flat tab strip became grouped dropdowns; settings.tsx uses PageHeader.

Where July was still the better answer, it won:

• /brief now queries real PRs, deploys, activity and savings instead of rendering demo defaults over a signed-in session.
• The repo-scoped audit log gets RepoHeader+RepoNav — it had been rendering with no nav at all. Merged rather than adopted wholesale: the chrome prop selects repo chrome or canonical's settings shell.
• routes/repo-health.tsx deleted — 614 lines never mounted in app.tsx. (lib/repo-health.ts, which is used, is a different file.)

Four bugs that were still live on canonical

• advisories.tsx highlighted active="code" instead of Security
• code-scanning.tsx highlighted active="gates" instead of Security
• automation-settings.tsx rendered no RepoNav
• /settings/email-verification had no settings nav and no inbound link

Packages, Codebase migrator, Docs tracking and AI changelog were reachable routes missing from the nav; they're now in it. The AI CTA strip that carried three of them is dropped — a workaround for a then-locked RepoNav, duplicating the AI menu, styled in a purple the Natural Light palette forbids.

Two defects found while merging

Neither was in either branch's diff:

• orgs.tsx add-member race — an existence SELECT paired with an unguarded INSERT. Concurrent adds both passed the check and both inserted. Now onConflictDoNothing against org_members_unique, reading the outcome off the insert.
• Leaking test mock — settings-subnav-wiring.test.ts returned a live session/user from its process-global db mock with no reset, so a later file saw an authed 200 for a user that doesn't exist. Gated behind a flag afterAll clears.

Also removed health-score.tsx's /:owner/:repo/insights redirect: insights.tsx serves that path with a real hub and mounts first, so the redirect was shadowed and never ran.

Verification

• tsc --noEmit clean.
• 4627 pass / 7 fail, vs 4583 / 14 on unmerged canonical — +44 tests recovered, and all 7 remaining failures reproduce on the baseline worktree. Zero regressions.

Tests asserting relocated markup were repointed at where the behaviour now lives, not deleted.