Send the signed-in person to GitHub's install page

Seal a state and send the browser to GitHub.

target is the console's "Configure on GitHub" link (task 15 G1.2). It changes only the destination: the state is sealed exactly as it is without one, so the return trip is the same callback under the same session rule, and the update branch that already exists does the re-mirroring. This route — never a link the console assembles — is why configuring by hand no longer ends in state_invalid: a hand-typed github.com configure page carries no state, and ours does.

An installation the session's account does not hold answers 404 with the same body an id that never existed gets. There is no oracle here on purpose: installation ids are small global integers, and a different answer for "somebody else's" would turn this route into a way to ask whether an arbitrary id is installed anywhere.