fix: select latest native check rerun

[kazukinakai]

Summary

• accept legitimate reruns from the same protected workflow path
• select the highest check-run ID as authoritative
• preserve exact context and workflow-path matching
• fail when multiple correct-path candidates lack unambiguous IDs
• pin caller and implementation to the reviewed fix commit

Production evidence

Repeated canary reopen events left multiple successful native check runs from the same protected workflow path. The previous evaluator rejected these legitimate reruns as duplicates.

Verification

• python3 -m unittest discover -s tests (38 passed)
• shell and Node syntax checks
• actionlint v1.7.7
• git diff --check