gh: IsInstalledGitHubApp matches installations by prefix — can pick the wrong installation (myorg vs myorg-other)

[whywaita]

Problem

IsInstalledGitHubApp (pkg/gh/jwt.go:45) matches the requested scope against installations with a prefix comparison:

if strings.HasPrefix(inputScope, *i.Account.Login) {

HasPrefix("myorg-other/repo", "myorg") is true, so if the App is installed on both myorg (with repository_selection: all) and myorg-other, a target for myorg-other/repo can resolve to myorg's installation ID — depending on iteration order — and subsequent tokens are minted for the wrong installation. Symptoms would be confusing 404s from the GitHub API or, in the worst case, operations performed with another org's installation token.

Related nits in the same file

• Raw pointer dereferences *i.Account.Login, *i.RepositorySelection, *i.ID (pkg/gh/jwt.go:45,51,53,57) — go-github provides GetLogin() etc. that are nil-safe.
• ErrIsNotInstalledGitHubApps.Unwrap() (pkg/gh/jwt.go:81-83) constructs a brand-new error on every call, so unwrapping never terminates in a matchable sentinel; it adds nothing and breaks errors.Is expectations. It should be removed (the type already works with errors.As).

Suggested fix

Compare the owner segment exactly:

owner := strings.SplitN(inputScope, "/", 2)[0] // scope is "org" or "org/repo"
if strings.EqualFold(owner, i.Account.GetLogin()) { ... }

and switch to the GetX() accessors.