Pending GitHub installs GitHub itself attributed to THIS session's identity.

What this fixes: the claim card rendered only from the callback's one redirect, so losing it -- closing the tab, or installing from GitHub's own UI, which sends no redirect at all -- made the install unreachable through the product forever.

PROOF OF CONTROL. A bearer-authenticated GET has no GitHub token (the claim's is exchanged per attempt and never persisted), so the claim's per-row GET /user/installations proof is unavailable here. Rather than weaken it, this uses a STRICTLY NARROWER one: a row is listed only when GitHub attested a specific account as the install's OWNER (installer_github_user_id -- the webhook sender, or a callback token holder who passed the claim's ownership test, write-once) AND the session subject IS that account, as github|<id> compared to the subject directly. Access-grade identity is deliberately not enough, and a non-GitHub session therefore lists nothing rather than everything.

So it cannot enumerate (the filter takes no caller input at all -- the id comes from the authenticated subject) and it is not a trust anchor (it only DISCLOSES; binding stays with /link/start -> /link/callback, which re-proves ownership against the claimant's own token). SETTINGS_MANAGE, as /link/start requires.