feat(github-app): per-file/line check-run annotations

[JSONbored]

Parent roadmap: #525
Parent phase: #528

Background

The check-run surface exists (#272, closed) but the code only sends {title, summary, text} — the GitHub Checks output.annotations[] array is unused, so maintainers can't see per-file/line hotspots.

Goal

Add per-file/line annotations to the Gittensory Context check for duplicate-overlap, missing-test, and slop hotspots.

Current Behavior

createOrUpdateNamedCheckRun (src/github/app.ts) passes only title/summary/text; grep annotations over the check path is empty.

Desired Behavior

• Extend the check helper to send output.annotations[] (path + line + level + message), cap 50 with a "…N more" rollup.
• Hotspot data reuses buildCollisionReport + PullRequestFileRecord. Annotate the Context check only; keep Gate a clean binary for branch protection.
• Render readiness/cluster tables in the Context details page gated by the existing checkRunDetailLevel.

Implementation Requirements

• Annotation level maps from finding severity. Builds on feat(github-app): publish public-safe check-run annotations #272's public-safe check surface.

Public/Private Output Boundaries

• All annotation messages routed through sanitizeForCheckRun. No raw trust/credibility numbers or reward language.

Acceptance Criteria

• Annotations appear on changed lines for real hotspots; Context stays non-required; output is public-safe.

Testing Requirements

• npm run test:ci, 97%+ coverage. Unit tests for annotation building + the 50-cap; sanitizer tests for messages.

Sub-issues

• feat(github-app): check-run annotation builder #574 annotation builder (non-visual)
• feat(github-app): wire check-run annotations output #575 wire annotations output
• feat(github-app): check-run details-page tables (visual) #576 details-page tables (visual — lower priority)