merge checker to use the core/httpclient with baseurl transport

[rashmi-prithyani]

Why?

The merge checker was building its HTTP client ad-hoc in main.go — a local bearerTransport for auth and a hardcoded GITHUB_GRAPHQL_URL for the full GraphQL endpoint. This was inconsistent with how the change provider was refactored (D→ previous PR): a shared core/httpclient package owns transport construction, and extensions only accept a pre-configured *http.Client.

What?

• Removed GraphQLURL from Params — the full URL is no longer passed into the merge checker. Instead, BaseURLTransport (in core/httpclient) rewrites relative /graphql requests to the full URL transparently, the same way the change provider works.
• Removed local bearerTransport from main.go — replaced with oauth2.Transport from golang.org/x/oauth2, consistent with the change provider.
• newMergeChecker now mirrors newChangeProvider — both use httpclient.NewClient(GITHUB_BASE_URL) + oauth2.Transport for auth + configurable timeout. Both read from the same GITHUB_BASE_URL env var instead of the merge checker having its own GITHUB_GRAPHQL_URL.
• BUILD.bazel — added //core/httpclient dep to the merge checker test target.

Test Plan

• All 29 unit tests pass (make test)
• Lint, tidy, gazelle, and build all pass (make lint, make check-tidy, make check-gazelle, make build)
• newTestMergeChecker in checker_test.go updated to use httpclient.NewClient — existing table-driven tests cover all merge check scenarios (mergeable, conflicting, stale SHA, unknown state, server error)