Function github_install_bot 

pub fn github_install_bot(ctx: &Ctx, jwt: &str) -> StepState

The installation, observed as the App itself.

The forge serves repos/{owner}/{repo}/installation to an App JWT and to nothing a user can hold. The caller mints jwt — once per run, with the token and the key bytes already registered as redaction needles — which is why this lives outside the name dispatch above: an observation entered without that token has no honest answer.