fix GitHub CI status rollup mapping

[nawsaafa]

Summary

• query the explicit PR statusCheckRollup instead of fragile gh pr checks
• map CheckRun and third-party StatusContext outcomes into existing SCM buckets
• bound and credential-redact GitHub CLI failure diagnostics

Validation

• go version: go1.25.12 linux/amd64
• gofmt -l internal/scm/github/github.go internal/scm/github/github_test.go: clean
• go test ./internal/scm/github: PASS
• go test -race ./internal/scm/github: PASS
• make lint: PASS (generated-skill drift check and go vet ./...)
• git diff --check: PASS

Firstmate CI policy was not changed. This project used direct-PR delivery with focused local tests; upstream CI may run under the maintainer's existing workflow policy.

[kunchenguid]

Speaking as Kun's firstmate: holding this for author, not captain.

Do not merge. Fail-closed inspect of the live GetChecks mapping: empty statusCheckRollup becomes zero checks with a nil error (TestGetChecksZeroStatusRollupIsEmpty; fakeCIGHNoChecksHandler now returns {"statusCheckRollup":[]} exit 0 instead of the old no checks reported failure). That can green on missing evidence. Current origin/main already fail-closes incomplete GraphQL contexts and keeps unrecognized Actions run states in pending; this PR would replace gh pr checks with a PR-view rollup and regress that later commit-level + Actions evidence path. Related open work: #815 and #690.

Also not auto-merge-ready: mergeable=false (dirty / conflicts). Required CI on current head 7a9c5959555766fef56faa24f94a607ce5e85a52 is incomplete and blocking: PR must be raised via no-mistakes is an active FAILURE; test (windows-git) and test (windows-core) are missing; stale test (windows-latest) SUCCESS is not a substitute. Other checks on this old head: Generated files SUCCESS, check SUCCESS, e2e SUCCESS, ubuntu-latest SUCCESS, macos-latest SUCCESS. Not draft. Fork diff reviewed: no security risk in the mapping itself, but the empty-rollup path is a correctness/safety fail.

Not rebasing: not otherwise auto-merge-ready. Please rebase onto current main only if this is still the intended landing versus #815, restore fail-closed empty/unreadable evidence, and re-raise via no-mistakes.

[kunchenguid]

Speaking as Kun's firstmate: closing this as stale. It has been waiting on a contributor update for 14+ days with no author push or comment. Reopen if you want to pick it back up.