Put the config guard inside the build that people actually run

Removing the GitHub vars from the wrangler files left
`production:config:check` still expecting them, and I found that by looking
rather than by running anything — the guard is not part of `npm run build`,
so a full green local run proves nothing about it. That is exactly how the
Google callback slipped through on 10 August: the deploy failed in CI,
production sat on new schema with old code until a second deploy landed.

Twice is a pattern, and the pattern is not carelessness — it is a check
that only ever runs somewhere I am not. So it moves into `build`, right
after `orbit:validate`: before the slow asset work, so a config mistake
fails in seconds rather than after a full site build.

The guard itself now expects one callback and no owner ID, matching the
configs. The comment about deriving the URL from `expected.origin` stays,
because the reason survives the second provider leaving: a literal string
would compare equal in precisely the case worth catching, live and
dark-launch crossed.

Local proof: `npm run build` end to end, now including 78 config
assertions.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: sametbasbug

package.json

@@ -16,7 +16,7 @@
   "type": "module",
   "scripts": {
     "dev": "astro dev",
-    "build": "npm run test:d1 && npm run orbit:test && npm run orbit:validate && npm run og:generate && astro build && npm run site:test && npm run browser:test",
+    "build": "npm run test:d1 && npm run orbit:test && npm run orbit:validate && npm run production:config:check && npm run og:generate && astro build && npm run site:test && npm run browser:test",
     "worker:build": "astro build --config astro.worker.config.mjs && wrangler deploy --dry-run --config wrangler.jsonc --outdir dist/worker",
     "worker:build:staging": "ORBIT_SITE_URL=https://orbit-v6-staging.samett33710.workers.dev ORBIT_NOINDEX=true astro build --config astro.worker.config.mjs && node scripts/orbit-staging-assets.mjs && wrangler deploy --dry-run --config wrangler.staging.jsonc --outdir dist/worker-staging",
     "worker:assets:production:live": "ORBIT_SITE_URL=https://orbit.sametbasbug.dev ORBIT_NOINDEX=false astro build --config astro.worker.config.mjs",

scripts/orbit-production-config-tests.mjs

@@ -108,7 +108,6 @@ const expectedTopLevelKeys = [
 
 const expectedCommonVars = {
   ORBIT_ENVIRONMENT: 'production',
-  ORBIT_PLATFORM_OWNER_GITHUB_ID: '126420524',
   ORBIT_BACKUP_ENABLED: 'true',
   ORBIT_MEDIA_ENABLED: 'true',
   /* Kayıt kapısı. Davet sistemi emekliye ayrıldı ve kapı açıldı; bu değer
@@ -205,14 +204,10 @@ function validateConfig(config, expected) {
       ORBIT_ENVIRONMENT: 'production',
       ORBIT_DEPLOYMENT_MODE: expected.mode,
       ORBIT_ALLOWED_ORIGIN: expected.origin,
-      /* İki sağlayıcı, iki dönüş adresi. GitHub'ınki GEÇİCİ — mevcut
-       * hesapların Google'ı bağlaması bitince o satır da bu liste de
-       * kısalacak. Adresler kaynağa değil `expected.origin`e bağlı, çünkü
-       * yanlış olabilecek tek şey buranın canlı ile dark-launch arasında
-       * karışması. */
-      ORBIT_GITHUB_CALLBACK_URL: `${expected.origin}/v1/auth/github/callback`,
+      /* Adres kaynağa değil `expected.origin`e bağlı, çünkü yanlış
+       * olabilecek tek şey buranın canlı ile dark-launch arasında
+       * karışması — elle yazılmış bir dize tam o durumda eşit çıkardı. */
       ORBIT_GOOGLE_CALLBACK_URL: `${expected.origin}/v1/auth/google/callback`,
-      ORBIT_PLATFORM_OWNER_GITHUB_ID: '126420524',
       ORBIT_OPEN_REGISTRATION: 'true',
       ORBIT_BACKUP_ENABLED: 'true',
       ORBIT_MEDIA_ENABLED: 'true',
@@ -232,7 +227,6 @@ function normalizeModeDifferences(config) {
   delete normalized.workers_dev;
   delete normalized.vars.ORBIT_DEPLOYMENT_MODE;
   delete normalized.vars.ORBIT_ALLOWED_ORIGIN;
-  delete normalized.vars.ORBIT_GITHUB_CALLBACK_URL;
   delete normalized.vars.ORBIT_GOOGLE_CALLBACK_URL;
   return normalized;
 }