fix(tasks): "Create PR" from an inbox report can start a run with no GitHub credentials

Problem

Pressing Create PR (or asking for code work via Ask AI) on an inbox report that has no persisted repo selection creates a repo-less signal_report task. A repo-less task gets no GitHub integration attached, so the sandbox boots with no GH_TOKEN/GITHUB_TOKEN and no credential-refresh loop. Because posthog/posthog is public, the agent can still clone it unauthenticated — so it does all the work, and only the final git push / gh pr create fails with no GitHub token in env. The run ends with a .patch artifact instead of a PR, and the report keeps no implementation_pr_url.

This has hit several real runs. The failure is deterministic (not transient) and surfaces hours after the button press.

Mechanism

1. The web inbox kickoff intentionally omits repository — "the backend resolves it for signal_report tasks" (products/signals/frontend/inbox/inboxTaskKickoffLogic.ts, createReportTask).
2. create_task resolves it from persisted_repo_selection(report_id), falling back to cascade_select_repository (products/tasks/backend/facade/api.py, the signal-report resolution block). The cascade is deliberately "never block the run — every failure degrades to no repo" (products/tasks/backend/logic/repo_selection/cascade.py).
3. The cascade only matches bare owner/repo tokens via extract_explicit_repo (posthog/git.py). The failing reports named the repo only as GitHub issue URLs, which extract_linked_repo (same module, unused here) would have resolved.
4. With no repository, the team GitHub integration is never attached, has_github_credentials is false, and provisioning injects no token (products/tasks/backend/temporal/process_task/activities/provision_sandbox.py, _resolve_sandbox_github_token).

Proposed change

1. Add the URL tier to the fallback: chain extract_linked_repo after extract_explicit_repo in the signal-report repo resolution, so a report that links exactly one connected repo resolves to it. Scope it to the signal-report path if other cascade callers should not take the weaker-evidence tier.
2. Fail fast: when a signal_report task with the implementation relationship (the default) still resolves no repository, reject creation with a clear validation error (for example: "This report has no linked repository — pick one to create a PR") instead of creating a run that cannot ship. The web kickoff already surfaces server error detail as a toast (handleKickoffError), and PostHog Desktop always sends a repository, so no client change is required.

Out of scope

• Discussion-relationship tasks stay repo-less by design — that shape defines the Inbox entitlement exemption (task_exempt_from_code_access).
• Telling the sandbox agent it has no push credentials (separate issue).
• Stamping a repo selection at report-emit time (separate issue).

Start with products/signals/frontend/inbox/inboxTaskKickoffLogic.ts and the signal-report resolution block in products/tasks/backend/facade/api.py. Read the fallback in products/tasks/backend/logic/repo_selection/cascade.py and extract_explicit_repo/extract_linked_repo in posthog/git.py. Done means linked GitHub issue URLs resolve the repository, while implementation reports without one fail clearly and discussion tasks remain repo-less by design.