fix: process repositories in batches to prevent partial sync on large orgs

[roryharness]

Problem

SettingsRepository.eachRepositoryRepos fetches every repository in the installation and processes them all at once with a single Promise.all(...) over the full list. On large organizations this has two problems:

1. Unbounded concurrency — thousands of checkAndProcessRepo calls fire simultaneously, creating heavy API/memory pressure.
2. Partial sync on any failure — Promise.all rejects as soon as one repository fails, aborting the entire run. Repositories that hadn't been processed yet are silently skipped, leaving the org partially synced.

Fix

• Process repositories in fixed-size batches (CONCURRENCY = 10) instead of all at once, bounding concurrency and API pressure.
• Use Promise.allSettled per batch so a single repository's failure no longer aborts the whole sync. Failed repositories are logged via log.error and processing continues.
• Aggregate and return the successfully processed results.

This makes full-org syncs resilient: one bad repository no longer prevents the rest of the org from being synced.

Additional change

• Add COPY full-sync.js /opt/safe-settings/ to the Dockerfile so the full-sync entrypoint is present in the built image (it was previously omitted).

Behavior / compatibility

• Behavior for small orgs is unchanged aside from batching; all repositories are still processed.
• No public API or configuration changes.