Epic: ORB self-hoster issue & milestone planning routine (gittensor-optional)

[JSONbored]

Problem

Two working precedents for "AI plans -> real GitHub issue" already exist: generateContributorIssueDrafts (src/services/contributor-issue-draft.ts) and fileUpstreamDriftIssues (src/upstream/ruleset.ts:325). Both are hardcoded to loopover's own repo, and both write via a flat operator PAT (LOOPOVER_CONTRIBUTOR_ISSUE_TOKEN / LOOPOVER_DRIFT_ISSUE_TOKEN / GITHUB_PUBLIC_TOKEN) instead of the installation-token/Orb-broker path every other GitHub write in this codebase uses (src/github/app.ts's makeInstallationOctokit, src/orb/broker-client.ts). There is also no milestone-creation capability anywhere — every milestone reference in the codebase is either the milestoned/demilestoned webhook event being tracked read-only (src/github/webhook.ts) or an unrelated Linear-integration field.

Selfhosters running ORB on their own repos have no way to have ORB plan and file real issues/milestones against their own backlog, whether or not that repo is enrolled in gittensor.

Area

src/services/contributor-issue-draft.ts, src/upstream/ruleset.ts, src/github/app.ts, src/github/client.ts, src/orb/broker-client.ts, src/mcp/server.ts, src/review/gittensor-wire.ts, src/registry/sync.ts.

Proposal

Generalize the existing draft -> dedupe -> create pattern into a repo-agnostic MCP tool any selfhoster can call against their own installed repo:

1. Auth is generalized off the flat-PAT pattern onto the installation-token/Orb-broker path first (blocking prerequisite) — the new tool must work on any repo the selfhoster's App/Orb is already installed on, with no separate token to configure.
2. The core planning tool defaults to draft-only output; an explicit flag is required before anything is written to GitHub.
3. Milestone creation/assignment ships alongside issue planning in v1 (net-new capability, not deferred).
4. Gittensor enrollment (.loopover.yml's experimental.gittensor) is an optional input that enriches planning context — never a gate on whether the feature works, matching gittensor-wire.ts's existing "zero footprint if not enrolled" contract.

Deliverables

• Spec: generalize GitHub write path for issue/milestone creation off flat-PAT onto installation-token/Orb-broker (see linked sub-issue)
• Spec: repo-agnostic issue-planning MCP tool, draft-by-default with explicit create (see linked sub-issue)
• Spec: GitHub milestone creation/assignment capability, net-new (see linked sub-issue)
• Spec: gittensor-enrollment-aware planning enrichment, optional input only (see linked sub-issue)
• Spec: selfhoster config surface + docs for the planning routine (see linked sub-issue)

Resources

• src/services/contributor-issue-draft.ts, src/upstream/ruleset.ts:325 (existing draft/dedupe/create pattern to generalize)
• src/github/app.ts, src/github/client.ts, src/orb/broker-client.ts (the write path every other GitHub-write feature already uses)
• src/mcp/server.ts (registration site for the new tool, alongside generateContributorIssueDrafts)
• src/review/gittensor-wire.ts, src/registry/sync.ts (enrollment-gated enrichment pattern to mirror)
• .claude/skills/contributor-pipeline-gardening/reference.md (existing human convention for milestone reuse across recurring rounds, to match rather than reinvent)

Boundaries

• No scheduled/automatic firing in this epic — MCP-tool-triggered only. An "auto-fire on a cadence" mode is a later epic.
• No dashboard/approval UI in this epic.
• AMS is out of scope entirely — it is the contributor-side agent runtime, a structural mirror of ORB with no reusable GitHub-write plumbing; its only sanctioned coupling to ORB is the one-directional, pull-only reputation bridge (src/review/ams-reputation-bridge.ts), unrelated to this feature.
• Must not weaken the Orb broker's existing "never trust the caller's installation_id" guarantee (src/orb/broker.ts).

[linear-code]

JSO-5285