DL-585

Each GitHub account that installs the App is bound to one tenant per forge host, keyed by account id; InstallationResolver checks the caller tenant’s binding by login before the snapshot, so a foreign owner returns ErrNoInstallation on the same path, code and timing as an owner with no installation, and a binding-store fault is never ErrNoInstallation

Status: Active (Matt, 2026-10-18)