Scope repository search to the account `user:` names

`GET /search/repositories` dropped every qualifier, so `user:integ-user`
and `user:Toolathlon-Archive` both answered with all ten repositories the
tenant holds. Dropping a qualifier is safe only when it WIDENS -- `in:name`
and `language:` do -- and `user:`/`org:` narrow, which is the only reason a
caller writes one. The surplus rows are indistinguishable from an answer, so
a caller asking what an account owns is told something untrue rather than
something loose.

The looseness that is on purpose stays: terms still OR rather than AND, a
hyphenated term still matches its parts, and an unscoped query still reaches
every owner.

The github selftest is where this lands because the corpus cannot reach it:
`search_repositories` is an MCP tool with no `gh` subcommand behind it, so a
battery that drives the CLI never asks the route a question. Check 89 fails
on the old handler.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>