feat(webhooks): let each trigger choose its GitHub organization

[RSO]

Why this PR exists

#5564 gives webhook triggers a place to persist GitHub installation identity, but users still need a safe way to choose it. The current form identifies repositories by name, so duplicate repositories from different installations are indistinguishable and editing a trigger can silently switch to another installation.

This PR exposes the backend capability only after preserving repository + account + integration as one selection.

Place in the rollout

This is the UI child of #5564. The split is intentional: #5564 makes storage and execution backward-compatible; this PR is the point where new triggers can actually target secondary GitHub organizations.

Dependency

Depends on #5564. Merge and deploy the backend contract first, then retarget this PR to main.

What changes

• Group trigger repositories by GitHub installation account.
• Distinguish duplicate accounts/installations.
• Preserve platformIntegrationId in create and edit form state.
• Submit the chosen integration with trigger mutations.
• If an edited trigger's pinned installation is missing, show an actionable warning and Integrations link instead of selecting another match.

What stays unchanged

• Existing triggers without a pin still load through the backend compatibility path.
• Editing a trigger does not silently change its repository or installation.
• Trigger execution logic remains in feat(webhooks): remember which GitHub install owns each trigger #5564.

Why this adds a selector component

The existing generic repository field cannot represent duplicate names or unavailable pinned values. The new component keeps that identity handling local to webhook forms rather than broadening a shared selector used by unrelated products.

Review guide

Review github-repository-selection.ts first; it contains the pure grouping and stale-pin rules. Then verify TriggerForm sends the selected ID on both create and edit.

Validation

• 2 focused selector suites, 5 tests
• Web typecheck and lint
• git diff --check

Browser testing was skipped because no local services were running.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (8 files)

• apps/web/src/app/(app)/cloud/webhooks/[triggerId]/EditWebhookTriggerContent.tsx
• apps/web/src/app/(app)/cloud/webhooks/new/CreateWebhookTriggerContent.tsx
• apps/web/src/components/webhook-triggers/GitHubRepositorySelector.test.ts
• apps/web/src/components/webhook-triggers/GitHubRepositorySelector.tsx
• apps/web/src/components/webhook-triggers/TriggerForm.tsx
• apps/web/src/components/webhook-triggers/github-repository-selection.test.ts
• apps/web/src/components/webhook-triggers/github-repository-selection.ts
• apps/web/src/components/webhook-triggers/types.ts

---

_{Reviewed by grok-4.6 · Input: 284.6K · Output: 20.1K · Cached: 449.7K}

_{Review guidance: REVIEW.md from base branch multi-github/18-webhook-trigger-backend}