D2: GitHub social-preview cover when no live_url (#172)

[xenodeve]

Parent

Part of #172

What to build

End-to-end: published GitHub-bound projects with null snapshot_image and no usable live_url can receive a cover from the GitHub repository page social preview (og:image / twitter:image), persisted into snapshot_image. Secret-guarded endpoint, dry-run by default, apply:true to persist, fail-soft per project, revalidate on successful applies. Pure eligibility helpers are unit-tested; HTTP contract matches live-url fill style. Wire into cron or document operator trigger alongside screenshot workflow.

Acceptance criteria

• Pure helpers select only published + gh-bound + null snapshot + blank/missing live_url targets
• Absolute http(s) OG URLs only are persisted; invalid/missing meta is a skip
• Dry-run does not write; apply persists and revalidates when any cover written
• Nest tests cover dry-run vs apply counts; no overwrite of existing snapshot_image
• After apply, a known no-live_url project (e.g. hype-macro-store if still blank) can get a non-null snapshot

Blocked by

None - can start immediately (independent of D1)