fix(github): treat completed third-party action_required checks as failing/manual-hold

[JSONbored]

Motivation

• A recent change classified a completed third-party check-run with conclusion === "action_required" as non-blocking/passing, allowing the agent to auto-approve and auto-merge PRs even when an external app requested human action.
• The goal is to preserve the fork-approval behavior for github-actions while treating completed third-party action_required verdicts as adverse/manual-hold signals so they cannot be bypassed by auto-maintain logic.

Description

• Change in src/github/backfill.ts: add isThirdPartyActionRequiredFailure and treat a completed non-github-actions action_required check-run as a failing/manual-hold result by pushing it into failingDetails instead of letting it count as passing or pending.
• Preserve the existing github-actions special-case so an Actions workflow awaiting "Approve and run" remains pending.
• Update the explanatory comment near CI_FAILING_CONCLUSIONS to reflect the new semantics for third-party tools.
• Update the regression in test/unit/backfill.test.ts to expect ciState === "failed" and a corresponding failingDetails entry for a completed third-party action_required check (the test previously asserted passed).

Testing

• Ran npx vitest run test/unit/backfill.test.ts -t "action_required" --reporter=dot, which executed the targeted regression tests for the changed behavior and they passed.
• Ran npm run typecheck which completed successfully.
• Ran git diff --check which reported no whitespace/conflict issues.
• A full run of npx vitest run test/unit/backfill.test.ts --reporter=dot in this environment hit unrelated timing failures (two existing tests timed out) that are not related to the change; those environment timeouts should be re-run in CI or locally with increased test timeout if needed.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.96%. Comparing base (64fb1a3) to head (c499f4f).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4414   +/-   ##
=======================================
  Coverage   93.96%   93.96%           
=======================================
  Files         401      401           
  Lines       36892    36892           
  Branches    13490    13490           
=======================================
  Hits        34667    34667           
  Misses       1569     1569           
  Partials      656      656           

Files with missing lines	Coverage Δ
src/github/backfill.ts	97.05% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.