#26804 fix: preserve GitHub integration callback team scope

Fix integration callbacks to preserve their originating team scope.

A Settings GitHub App connection started inside a shared team receives a signed state containing that team. The dashboard callback now decodes only the team-shaped claim as an untrusted routing hint and passes it as x-cmux-team; the API remains authoritative and verifies the signed state, user, connection, and team before completion. Personal-team callbacks use the same path without changing API behavior.

"one "Connect GitHub" in Settings and onboarding that uses the cmux GitHub App broker"

Changes:

• Add a bounded JWT-payload routing helper that accepts only team_<20 hex> claims.
• Extract the completion request frame so the callback and regression test share the same path.
• Cover shared/personal team routing and malformed/tampered state.

Validation:

• Focused fleet test passed on the previous head: run 40658965046.
• Exact-head focused fleet test passed (4 tests): run 40659508908, after restricting callback parameters to the provider fields and adding a conflicting-dashboard-scope regression.
• This changes callback request routing only; rendered UI is unchanged.

Agent session: agent session