feat: reconcile stale GitHub PR status

[Codename-11]

Summary

• add a webhook-first, stale-only repair loop for native GitHub implementation PR links
• aggregate all check suites plus legacy commit status before trusting completion evidence
• contain rate limits, permission failures, timeouts, manual refresh collisions, and shared-worker time with settings-driven backoff and budgets
• slowly re-probe closed PRs so missed reopen events self-heal
• expose sync/retry diagnostics and reconciliation policy in workspace connection settings

Verification

• lint (existing repository warnings only)
• typecheck
• focused reconciliation/completion coverage: 22/22
• full Vitest: 1,259 passed, 1 intentional live-connector skip
• production build
• serial Playwright: 38/38

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b3d4c12441

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Persist GitHub retry headers for manual refresh failures

When a manual refresh hits a provider error before upsertExternalResource() runs, this lease remains the only persisted state: the thrown GitHubRequestError is not caught, so syncRetryAt stays at the temporary lease deadline instead of the provider reset/backoff and syncLastError is not recorded. For a user clicking Sync during a GitHub 429/403/timeout, subsequent manual/background attempts can retry as soon as the short lease expires rather than respecting the rate-limit reset, while the issue panel has no diagnostic for the real failure.

Useful? React with 👍 / 👎.