feat: own the Origin install handshake on the adapter

[Meldiron]

What does this PR do?

Origin has no OAuth2 — installs are approved on Cursor and confirmed by an EdDSA-signed installation receipt, with no authorization-code exchange. That left consumers (Appwrite) modelling the handshake as an OAuth2 client subclass: ~330 lines whose only live methods were building the install URL and verifying the receipt, wrapped in dead getTokens()/getUser*() ceremony and a duplicate of this adapter's Ed25519/JWKS machinery.

The adapter now owns its own protocol, next to the webhook verification that already trusts the same signing keys:

• getInstallUrl(string $appId, array $scopes = [], string $redirectUri = '', string $state = ''): string — the install-page URL on {webEndpoint}/apps/install, including the quirk that an empty scope list must send source=app-metadata (the install page refuses an explicit empty list).
• verifyReceipt(string $receipt, string $appId): array — full receipt verification: JWT structure, EdDSA algorithm, the origin-installation-receipt+jwt media type (tolerated absent, never another token kind), signature against the published JWKS by kid, issuer, audience, exp/nbf/iat with 60s leeway, and a required sub. Returns the claims.
• getSigningKeys(bool $refresh = false): array — the active Ed25519 keys as base64url raw material, the shape validateWebhookEvent() accepts, so webhook consumers can stop hand-fetching the JWKS; $refresh supports the rotation-retry pattern.

JWKS entries are fetched through the adapter's own call() and memoized per instance; key resolution reuses the existing ed25519PublicKey().

First consumer: appwrite/appwrite#13259, which deletes its Auth\OAuth2\Cursor class in favor of these methods (follow-up there once this is tagged).

Test Plan

Credential-free, following the existing webhook-test pattern (locally generated sodium keys; a fixture subclass supplies the JWKS so the real verification path runs without network):

• testGetInstallUrl / testGetInstallUrlWithoutScopesReadsAppMetadata
• testVerifyReceipt — happy path returns sub/state/namespace_id
• testVerifyReceiptRejections — not-a-JWT, wrong algorithm, wrong token type, unknown kid, wrong audience, wrong issuer, expired, missing sub, signed by a different key
• testGetSigningKeys

OriginTest: 17 tests, 89 assertions, green. Pint and PHPStan (level 8, src + tests) pass.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR adds an Origin-owned installation handshake, including install URL construction, EdDSA receipt verification, and cached JWKS access.

• Builds Cursor installation URLs with explicit scopes or app-metadata scope discovery.
• Verifies installation receipt structure, signature, issuer, audience, temporal claims, and installation ID.
• Exposes Origin signing keys for webhook verification and adds credential-free fixture tests.

Confidence Score: 4/5

The signing-key cache recovery path should be fixed before merging because valid installation receipts can be rejected after key rotation or a transient JWKS failure.

Receipt verification always consults the existing per-instance JWKS cache and has no refresh-on-unknown-key path, despite the adapter explicitly supporting that rotation pattern for webhook keys.

Files Needing Attention: src/VCS/Adapter/Git/Origin.php

Important Files Changed

Filename	Overview
src/VCS/Adapter/Git/Origin.php	Adds the installation and receipt-verification APIs, but receipt key lookup cannot recover from signing-key rotation or a transient empty JWKS response.
tests/VCS/Adapter/OriginTest.php	Adds broad URL and receipt verification coverage using local Ed25519 fixtures, but does not exercise JWKS caching, refresh, or rotation behavior.

Prompt To Fix All With AI

### Issue 1
src/VCS/Adapter/Git/Origin.php:415
**Stale JWKS blocks valid receipts**
If an `Origin` instance is reused across signing-key rotation or after an empty JWKS response, `signingKey()` only consults the indefinitely cached key set and never refreshes it, causing valid installation callbacks to be rejected as signed with an unknown key for the remainder of the instance's lifetime.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat: own the Origin install handshake o..." | Re-trigger Greptile}