fix(github): third-party action_required check still auto-closed a PR on a repo with no branch-protection required contexts (#4812)

[JSONbored]

Problem

A contributor reported PR #4812 (JSONbored/metagraphed, author jimcody1995) closed this morning solely because Superagent's "Contributor trust" check reported action_required — despite every real CI check (tests, ui, codecov/patch, codecov/project) green, and despite #4414 having previously fixed exactly this class of bug ("a non-required advisory check must never auto-close a PR on its own say-so").

Confirmed via the actual close comment: Gittensory is closing this pull request on the maintainer's behalf (CI is failing (Contributor trust)). The review panel's own "Gate result" row correctly showed "Advisory; not blocking" — the close came from a separate code path.

Root cause

reduceLiveCiAggregate (src/github/backfill.ts) gates a third-party app's own action_required verdict on isRequired(name):

const enforceRequiredOnly = requiredContexts != null && requiredContexts.size > 0;
const isRequired = (name: string): boolean => !enforceRequiredOnly || requiredContexts!.has(name);

isRequired() is deliberately "assume required unless proven otherwise" — the right fail-safe for a genuine CI failure (an unconfirmed-required broken build should still block). But when enforceRequiredOnly is false (no branch-protection required-status-checks configured at all — confirmed live: JSONbored/metagraphed's required_status_checks.contexts is []), isRequired() returns true for every check name, including a third-party app's own advisory-only action_required verdict. #4414's fix only actually protects a repo that has SOME required contexts configured (so the code can tell "required" from "not required"); a repo with none configured falls through the fail-safe and reopens the exact #4414 bug.

Fix

Add a second, stricter helper (isConfirmedRequired) used only for the third-party action_required branch — enforceRequiredOnly && requiredContexts!.has(name), requiring POSITIVE confirmation rather than an "unknown → assume yes" default. isRequired() itself is untouched and still governs genuine CI-failure detection.

Deliverables

• isConfirmedRequired gates the third-party action_required → failingDetails branch, not isRequired
• Regression test reproducing Upgrade duplicationDelta's greedy block assignment to optimal bipartite matching #4812 exactly (empty required-contexts Set, matching the live branch-protection response) — a third-party action_required check stays in nonRequiredFailingDetails, never closes the PR
• Same coverage for the null (fetch-failed) origin of "no confirmed required contexts", not just the confirmed-empty case
• Full existing fix(github): treat completed third-party action_required checks as failing/manual-hold #4414 test suite still passes unchanged (repos that DO configure required contexts are unaffected)

[linear-code]

JSO-3419