feat(githubbot): skip centaur-skip checks, and read check detail without the Checks API

[oponder]

Two changes, and the second is why the first works.

Skip a check. A check with centaur-skip in its job id is dropped from the CI evaluation. We have checks a bot can never turn green because they require a human to act, and today githubbot burns all three fix attempts on them and then escalates. The marker rides the job id rather than the workflow name: GitHub recomputes the check-run name every run, but caches workflowRun.workflow.name per consuming repo for ruleset-injected required workflows, where a rename never reaches the API (verified — neither re-adding the ruleset entry nor opening a fresh PR rebuilds that record).

Read check detail without the Checks API. The filter needs readable per-check detail, and a fine-grained PAT — the token type GitHub recommends, with classic PATs on a deprecation path — has no Checks permission at all. So statusCheckRollup returns null check nodes and the evaluation degrades to the bare aggregate. That silently affects any deployment using one today: failingNames is always empty, so fix turns are dispatched with "Failing checks: unknown" and escalations say "Still failing: the CI checks".

When the nodes are unreadable, githubbot now rebuilds the checks from the Actions API, where a job is the same object as its check run. It trusts that reconstruction only when it accounts for every context GitHub counted — commit statuses and check runs from other GitHub Apps aren't Actions jobs — and otherwise keeps the existing aggregate behavior rather than call a PR green on a check it never saw.

No new configuration. GITHUBBOT_AUTO_MERGE and the merge path are untouched.

fixes PE-8596