feat(users): fall back to verified-domain emails when SAML lookup is unavailable

[hanikesn]

Why

Users synced from an org whose SAML SSO is enforced at the enterprise level come through without any email when the connector authenticates as a GitHub App. checkOrgSAML detects enterprise SAML, sees no --enterprises, and lands in samlStateDisabled. Even with --enterprises set, the enterprise path reads /enterprises/{enterprise}/consumed-licenses, which GitHub does not enable for GitHub Apps, so it needs a classic PAT with read:enterprise. GitHub's REST API for org members never returns emails, and most members keep their public email private.

Without an email C1 cannot correlate a GitHub account with an identity user. In our tenant every GitHub account had to be linked by hand after the user accepted the org invitation, and grant tasks for team memberships failed against the unlinked account in the meantime. Switching the connector to PAT auth just to read one endpoint trades an app installation for a personal token bound to an enterprise owner, which we did not want.

What

GitHub exposes User.organizationVerifiedDomainEmails(login:) via GraphQL to org-scoped credentials regardless of where SAML is configured. It returns the member's verified emails on the org's verified domains and needs only the Members read permission the app already has.

This adds a per-user fallback after the existing SAML branches: when no valid email was found, take the member's verified-domain emails, first valid one as primary, remaining as secondary. GraphQL errors are logged at warn and skipped, so orgs without verified domains behave exactly as before. SAML branches are untouched, no config changes.

Verification

• Org with enterprise-level SAML, GitHub App auth, 42 members: all 42 returned a verified-domain email through this query.
• New test runs the real List path against a GraphQL stub with no SAML provider and asserts on the emitted user trait: primary and secondary emails set, invalid entries dropped, empty list leaves the email empty without failing the sync. The test fails on upstream main.
• go build, go test ./..., go vet, golangci-lint run --new-from-rev=upstream/main all clean.