[TigerYWang]

What changes

An Admin, or a Member given App secrets in Team (the switch Publish already uses), can now do from a shared workspace's Your Apps what only the owner's own window could, with the owner's Mac off:

• Set where an app publishes on GitHub (repo, branch, folder, files left alone, workflow), or put it back on Orgo. Bops Cloud checks who asked and writes it on the owner's state itself (cloud/members.ts githubHere). A new repo, branch, folder or workflow needs a GitHub key of the workspace's own (This workspace, in Keys): the owner's key for all their workspaces stays the owner's to point (403 member_owner_only). The same folder with more files left alone keeps its link (cloud/github-config.ts keepsPoint, now one rule for the owner's Mac and Bops Cloud).
• Link it, and bring GitHub's changes in. Bops Cloud owes the job to the app's own computer as a chat turn that carries it (TurnMember.job, cloud/turns.ts takeAppJob): no migration, waking, leases, one at a time per chat and cancel on a removal all come from the turns. The runner does it (lib/server/runner-chat.ts runJob → lib/server/hosted-apps.ts githubJob) with its own Ingot token and its own sign in for the GitHub key, which never leaves Orgo's broker, says it in the bot's chat as Bops' own, and posts its result with the turn's end. Bops Cloud keeps it on the app (going, then how it went), and so does every way a job can end without its computer saying (can't wake, lost partway, access taken away, a runner from before).
• When the computer can't (runner older than the gate, none, app lost its computer, or no bot there given GITHUB_TOKEN), the owner's Mac does it as a member's other app acts, in the person's name (lib/server/member-acts.ts). Only the key missing with the Mac off is said at once (409 github_no_key: give the bot the GitHub key).
• Link takes files only Ingot has (lib/server/github-mirror.ts linkAndSay): a new client's own folder in a shared repo links, and goes up with the first Publish. A file GitHub has that Ingot lacks, or has otherwise, still gives LINK_DIFFERS.
• Your Apps gets a GitHub part for whoever may (SharedWsSlice.appGithub): where it publishes and when it was last the same, Bring in (asked first: GitHub's version wins where both changed a file), Link, Change where it publishes (Save and link), Publish on Orgo instead. An Admin's Publish waits, greyed with why, while the app isn't linked. The form moved to components/app/github-form.tsx so the owner's menu and Your Apps share it.
• The owner's own GitHub buttons say "Change it in this workspace's Your Apps." while a shared workspace is open (the guard stays: a viewer's own Bops never acts on its own app of that name).
• The owner's Mac merge keeps an app's GitHub setting whole (lib/server/state-merge.ts githubWhole): never a new repo with the old one's link point, never one side's commit with the other's changeset.

Why

A workspace whose apps publish to a shared GitHub repo needs its Admins to link a new client app and bring GitHub's changes in without waiting for the owner's Mac, and the work has to run where Ingot and the GitHub key both are: the app's own computer. Decisions followed: Admins always, a Member only with Your Apps at Write and App secrets; Link may accept files only Ingot has; a new destination only with the workspace's own GITHUB_TOKEN; the token never leaves the broker.

Versions

GITHUB_ACTS_MIN_VERSION = "0.0.52" (0.0.51 is being prepared without this). Bops Cloud refuses the acts (409 owner_bops_old) and shows no GitHub part until the owner's last Mac is at it; owes a job only to a runner at it (else the owner's Mac); shows the GitHub acts only to a viewer Bops at it (an older window would read one as a domain's). Older runners never get a job; one that did would read a system note and answer nothing, and a done with no result is kept as not done. Deploy order: Bops Cloud first (safe: gated on the owner's Mac version), then the release; the owner's Mac must open it once to roll the runners.

How I checked it

• npx tsc --noEmit -p . and npx tsc -p cloud/tsconfig.json --noEmit: clean. eslint on every touched file: no errors (the 4 warnings in scripts/test-hosted-apps.mjs are main's).
• Bops Cloud on a throwaway Postgres 18: node --test --test-concurrency=1 "cloud/test/core-*.test.ts" 380/380; "cloud/test/edge-*.test.ts" cloud/test/server.test.ts 196/196. New: 4 in core-members (cleanAct shapes, the slice's GitHub fields and flag, who may, the owner's own key), 5 in edge-turns (an Admin's Bring in end to end with the Mac shut, runner claim and result, a runner's state write moving only the point; Save and link with and without the workspace's key; keepsPoint and null; who may and the fallbacks; job ends the computer never says).
• Scripts: test-github-mirror 26 (2 new), test-runner-chat 13 (2 new), test-member-acts 41 (1 new), test-hosted-apps 143 (1 new), test-state-merge 42 (1 new), test-shared 71 (1 new), test-hosted-apps-ui 74 (1 new), and unchanged suites test-computer-scope 19, test-app-restore 22, test-keys 48, test-plain-words 9, test-members-ui 28, test-preview-password-ui 10. All pass.
• scripts/check-public.sh: OK.

Not done, and limits

• Built on main's Your Apps card: Your Apps: review changes before publishing #186 (AppReview) isn't merged. Its destination and status props should take this GitHub part when it lands.
• A job cancelled while it runs (access taken away mid pull) still finishes its Ingot write on the computer; Your Apps then says it didn't go. Ingot keeps the history.
• A Link or Bring in waits behind a chat answer running in the same bot chat (one at a time per chat).
• A viewer whose Bops doesn't say its version (a dev build) isn't shown the GitHub acts' rows.
• Not tried against a real Orgo, Ingot or GitHub: every service is a fake in the tests. The runner path needs a computer that can wake, an Ingot token for the workspace on it, and GITHUB_TOKEN given to a bot on it (that grant reaches orgo-web through the owner's Mac's access sync).
• No bot tool for it yet (the design's optional github_app).