ref(cursor-origin): Resolve the installation once per delivery

[wedamija]

Resolve the installation once at the webhook endpoint and pass the integration and
organization integrations to each handler. Unknown or missing installations are handled
by the endpoint, so handlers no longer need to extract or look up the installation
themselves.

This also lets repository lookups be scoped by organization, matching the other SCM
integrations.

[sentry]

Bug: A race condition can cause a valid, refreshed access token to be overwritten with a stale one during an integration update, breaking subsequent API calls.
_{Severity: MEDIUM}

Suggested Fix

To prevent overwriting fresh data with stale data, re-fetch the integration object from the database within the InstallationUpdatedHandler just before the metadata is updated and saved. Alternatively, use a database-level merge operation or implement locking.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/sentry/integrations/cursor_origin/handlers.py#L100-L104

Potential issue: A race condition can occur in the `InstallationUpdatedHandler`. The
integration's data is fetched at the webhook level and passed to the handler. If a
concurrent process refreshes the access token (e.g., via `_refresh_access_token()`), the
database is updated with a new token. However, the handler, holding a stale version of
the integration object, will then perform a metadata merge (`{**integration.metadata,
**changed}`) and save it. This action overwrites the new, valid token in the database
with the old, stale one, which can cause subsequent API calls for that integration to
fail.

Also affects:

• src/sentry/integrations/cursor_origin/webhook.py:214~220

_{Did we get this right? 👍 / 👎 to inform future reviews.}