[DEV-76] Auto-fix CI failures on DevIntern-created PRs

[danii1]

Summary

• continuously watch checks and commit statuses on open DevIntern-created PRs
• run bounded CI repair attempts through the existing address-review pipeline
• add an opt-in, live-reloadable [workspace].ci_failure_fix setting (default: false)
• record CI repair runs in the dashboard and persist retry/escalation state across restarts
• document the required GitHub Checks, Actions, and Commit statuses read permissions

Replacement for #51

This ports DEV-76 onto the current main after the original PR became stale and conflicted. It also fixes issues found during the review of #51:

• uses the GitHub Actions job-log endpoint instead of a nonexistent logs_url
• does not reset the retry budget while any check remains pending
• only deduplicates a failure after a successful fix invocation, allowing failed/no-op runs to retry
• preserves failure snapshots across conditional 304 responses
• serializes CI repair with review handling for the same PR
• avoids escalating immediately after a successful repair push while GitHub still reports the old head

Watch lifecycle

The watcher runs once at worker startup and every configured workspace poll interval. It watches only open PRs in the local agent_prs registry and stops when the PR closes, the repository is removed, the feature is disabled, or the worker stops. State survives worker restarts.

Configuration

[workspace]
ci_failure_fix = true

The setting defaults to false and live-reloads.

GitHub permissions

When enabled, the local token or customer-owned GitHub App needs:

• Checks: Read
• Actions: Read
• Commit statuses: Read

Existing customer-owned App installations must be re-approved after these permissions are added.

Validation

• @getdevintern/code: 1,368 tests passed
• @devintern/dashboard-ui: 100 tests passed
• isolated address-review regression file: 19 tests passed
• format, lint (0 errors), typecheck, and full monorepo build passed