fix(github): stop treating a completed third-party action_required check as pending CI

[JSONbored]

Summary

• reduceLiveCiAggregate's check-run classification excludes action_required from its failing-conclusion set on purpose, to protect a real scenario: a github-actions workflow awaiting maintainer "Approve and run" surfaces that way, and it is genuinely not-yet-run, not a failure.
• That exclusion applied to every app though, not just github-actions. A third-party app's own COMPLETED check-run reporting action_required as its terminal verdict (e.g. a security/trust-scan tool flagging a contributor) fell through to the exact same "still pending" bucket.
• Since that verdict can never change via any CI event gittensory observes, prReadyForReview deferred the review indefinitely — confirmed live: a PR stuck 30+ minutes across 8 outage-repair attempts before exhausting REGATE_REPAIR_MAX_ATTEMPTS_PER_SHA and falling back to slow passive sweep cadence, effectively never reviewed.
• Fix: only a github-actions-app check's action_required is treated as awaiting-approval pending CI now. Any other app's already-completed check-run reporting action_required is treated as a settled, non-blocking result (like neutral/skipped) instead — conservative default (an unknown/absent app slug stays pending, matching prior behavior) so this only changes behavior for a confirmed non-Actions app.

Scope

• Stayed within wantedPaths (src/, test/)
• No secrets/wallets/trust-score/reward values anywhere
• No changes to site/, CNAME, **/lovable/**, or CHANGELOG.md

Validation

• npm run typecheck
• npx vitest run test/unit/backfill.test.ts — 213/213 passing (no regressions), incl. 4 new tests: the third-party-settled fix, a regression test for the original github-actions awaiting-approval protection, an app-less conservative-pending case, and a not-yet-completed third-party case
• Verified branch coverage on every changed line via the raw coverage JSON (all branch counts non-zero) — the two lines the file-level report initially flagged are pre-existing, unmodified lines outside this diff (confirmed via git diff origin/main)

Safety

• No secrets/tokens in code, comments, tests, or this description
• Conservative by construction: only relaxes behavior for a check-run whose app.slug is confirmed and is NOT github-actions; every other case (unknown app, github-actions itself, not yet completed) keeps deferring exactly as before

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.96%. Comparing base (ca5576f) to head (a46a6fc).
⚠️ Report is 5 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4396   +/-   ##
=======================================
  Coverage   93.96%   93.96%           
=======================================
  Files         401      401           
  Lines       36869    36871    +2     
  Branches    13480    13482    +2     
=======================================
+ Hits        34644    34646    +2     
  Misses       1569     1569           
  Partials      656      656           

Files with missing lines	Coverage Δ
src/github/backfill.ts	97.05% <100.00%> (+<0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.