fix(observability): lead Sentry issues with the real error, not just the event slug

[JSONbored]

Summary

Self-host Sentry issues showed only the event slug as the title (e.g. orb_broker_unavailable) with the real failure buried in a "log" context blob — so operators had to open each issue and dig to learn what actually broke. The forwarder logged rich data but didn't surface it.

forwardStructuredLogToSentry now:

1. Leads the title with the real failure — "<event>: <message ?? error>" (e.g. orb_broker_unavailable: The operation was aborted due to timeout) instead of just the slug, so the issue list is self-explanatory.
2. Indexes filterable tags for the dimensions operators search + group by (repo, installationId, pull, pr, project, kind, deliveryId, …) — present values only.
3. Fingerprints by event so recurrences of one failure collapse into a single issue instead of fragmenting on the variable detail now in the title.

This pairs with the source-side instrumentation (#1605/#1619/#1625/#1627/#1628): those make failures reach Sentry at error level; this makes each issue legible at a glance (proper message + level + tags), so future problems surface as self-describing Sentry issues instead of something to hunt for.

Scope

• Conventional Commit title; focused (selfhost/sentry.ts + its test).
• No site//CNAME/Pages; follows CONTRIBUTING.md.
• Small self-evident extension of the feat(selfhost): observability hooks — @sentry/node error tracking module + boot/queue/review capture seams #1468 forwarder (no separate issue needed).

Validation

• git diff --check · actionlint · typecheck
• test:coverage — new test asserts the detail-led title + tags + fingerprint; existing forwarder tests (event-only title, message-only/fatal, generic fallback, routine-log skip, no-op-when-off) all still pass and cover the title ternary's other arms + the tag-loop's absent branch. Mock scope gains setFingerprint.
• test:workers · build:mcp · test:mcp-pack · ui:* · npm audit --audit-level=moderate

If any required check was skipped, explain why:

• No migration/OpenAPI/cf-typegen: forwarder formatting only.

Safety

• No secrets/wallets/trust-scores exposed — beforeSend (scrubEvent) still redacts secret-keyed fields before any event leaves the box; this only changes the title/tags built from already-logged, non-secret fields (event/message/error/repo/ids).
• No public GitHub text change · auth/CORS N/A.

Notes

• Self-host engine code (the forwarder runs under installStructuredLogForwarding); ships on the next engine rebuild.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.53%. Comparing base (758e524) to head (21678cc).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1636   +/-   ##
=======================================
  Coverage   95.53%   95.53%           
=======================================
  Files         204      204           
  Lines       22084    22090    +6     
  Branches     7972     7975    +3     
=======================================
+ Hits        21097    21103    +6     
  Misses        412      412           
  Partials      575      575           

Files with missing lines	Coverage Δ
src/selfhost/sentry.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.