docs(orb): separate telemetry from token brokerage

[JSONbored]

Parent: #1936

Problem

External self-hosters must not consume our GitHub API budget by default. The current system supports both direct GitHub App mode and brokered Orb mode, but the public operator story needs to make the safe ownership model explicit.

Requirements

• Direct per-team GitHub App installation is the default and recommended model.
• Brokered Orb token mode is private/managed beta only.
• Orb telemetry remains available in direct App mode so website counters and aggregate outcome data still work.
• Air-gapped mode remains available for operators who do not want telemetry.
• Document the privacy boundary: no source code, repo names, logins, secrets, or raw review text in telemetry.

Deliverables

• Update GitHub App setup docs to strongly prefer direct App mode.
• Update Orb docs to separate telemetry export from token brokerage.
• Add operational warnings for brokered mode: rate-limit blast radius, quota management, support burden, abuse/misconfiguration risk.
• Define minimum broker safeguards before any public brokered rollout: enrollment quota, per-install concurrency, per-install rate budget, revocation path, metrics by enrollment.

Acceptance criteria

• A beta operator can configure telemetry without using our token broker.
• Brokered mode cannot be mistaken for the public default.
• Docs explain exactly what data is exported and how to disable it.
• Maintainers have a clear go/no-go checklist before allowing brokered external users.

Expected outcome

We preserve central telemetry/counters without turning every external install into our rate-limit and reliability problem.

[linear-code]

JSO-2024

[JSONbored]

Correction to the token-cost model (docs-verified) — verdict: KEEP the Orb, don't eliminate

My earlier note (and the audit synthesis on #1936) said brokered mode "burns OUR shared 5000/hr budget." That was overstated. Per GitHub's rate-limit docs:

• Installation access tokens are rate-limited per installation (5,000/hr base, scaling to 12,500/hr) — not from a shared App-wide pool. So a brokered self-hoster's review/backfill/sweep calls run on their own installation budget, isolated from ours and from other installs. The {installation_id} is just routing, not a shared bucket.
• Telemetry export makes zero GitHub calls (src/selfhost/orb-collector.ts is pure push-ingest) — no token use at all.
• The only thing on our shared budget is token minting (POST /app/installations/{id}/access_tokens, src/orb/app-auth.ts:64). Mint/JWT/secondary limits are App-wide (community#196652), but the mint is cached ~1×/hour/install (app-auth.ts:58-60) and the cold-start herd is already single-flighted (fix(github): single-flight installation-token mint to stop the cold-start herd #1642).

Revised direction for this issue: keep the Orb telemetry/relay hub as the default onboarding path (zero-token, centralizes fleet calibration + homepage counter). Keep brokered token mode available but gated behind per-install mint + concurrency caps — the only genuine shared exposure is App-wide secondary limits on token generation, which a per-install cap bounds. "Eliminate the Orb App" is off the table; "gate brokered-mint safely" is the actual work. Webhook-aware backfill (rec #4 on #1936) is still worth doing for load, but is no longer an Orb-elimination prerequisite.