feat(github-app): publish public-safe check-run annotations

[JSONbored]

Parent roadmap: #127
Parent phase: #235

Goal

Use GitHub check runs for low-noise, public-safe PR guidance so routine Gittensory status does not need to become another comment thread.

Comments should stay opt-in or command-driven. Check runs should provide concise advisory state and safe annotations when the repository has enabled that surface.

Requirements

• Publish or update a Gittensory check run when repo settings enable check-run output.
• Keep annotations public-safe and concise.
• Prefer check-run status for routine state and comments for explicit commands/previews.
• Never include private reviewability, scoreability, reward/risk, wallet, hotkey, raw trust, or public score prediction.
• Respect missing Checks: write permission and surface a clear install/settings warning instead of failing noisily.

Acceptance criteria

• Check-run output is sanitized by the shared public-output safety suite.
• Existing comments remain opt-in and command/preview scoped.
• Missing permission behavior is tested.
• Check-run body and annotations are stable enough for maintainers to scan quickly.

Validation expected

• Unit tests for check-run creation/update and permission-missing behavior.
• Snapshot or semantic sanitizer tests for check-run summaries and annotations.
• npm run test:ci.