feat(batch): backfill-installation-membership CLI for PR 7 deploy prep (#283 PR 6/7)

One-shot data migration that runs after PR 1's schema deploy and before PR 7
flips repository lookups to strict mode. Assigns github_installation_id and
seeds repository_installation_memberships for organizations whose GitHub App
mode has exactly one active installation.

batch/commands/backfill-installation-membership.ts:
- Decision rules per org:
  - integrations.method = 'token' → skip (PAT mode never uses installation ids)
  - 0 active GitHub App links → skip + warn (org needs reinstall before PR 7)
  - exactly 1 active link → assign every NULL repo to that installation
  - 2+ active links → skip and list (operator must use reassign-broken-repositories)
- --dry-run flag for safe inspection
- Best-effort GitHub API call to seed memberships from installation_repositories;
  failures fall back to crawl-time membership repair
- Cross-store rule (tenant first / shared second) maintained
- Idempotent: WHERE github_installation_id IS NULL filter

batch/cli.ts:
- registered backfill-installation-membership command

tests (backfill-installation-membership.test.ts):
- single active link → backfills repos and memberships
- token method → skipped, no writes
- multi active link → not backfilled
- dry-run does not write
- idempotent: re-running on already-backfilled rows is a no-op

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: coji

batch/cli.ts

@@ -145,6 +145,33 @@ const report = command(
   },
 )
 
+const backfillInstallationMembership = command(
+  {
+    name: 'backfill-installation-membership',
+    parameters: ['[organization id]'],
+    flags: {
+      dryRun: {
+        type: Boolean,
+        description:
+          'Print the planned changes without writing to the database',
+        default: false,
+      },
+    },
+    help: {
+      description:
+        'One-shot migration: assign github_installation_id to repositories and seed memberships for orgs whose GitHub App method has exactly one active installation. Run before deploying PR 7 strict lookup.',
+    },
+  },
+  async (argv) => {
+    const { backfillInstallationMembershipCommand } =
+      await import('./commands/backfill-installation-membership')
+    await backfillInstallationMembershipCommand({
+      organizationId: argv._.organizationId,
+      dryRun: argv.flags.dryRun,
+    })
+  },
+)
+
 const reassignBrokenRepositories = command(
   {
     name: 'reassign-broken-repositories',
@@ -184,6 +211,7 @@ cli({
     classify,
     backfill,
     report,
+    backfillInstallationMembership,
     reassignBrokenRepositories,
   ],
 })