feat(github-app): publish public-safe check-run annotations (#272)

[enjoyandlove]

Summary

Closes #272

• Implements #272 — publish public-safe check-run annotations.
• src/rules/advisory.ts — formatCheckRunOutput now accepts detailLevel ("minimal" | "standard" | "deep"). minimal preserves existing static output. standard lists public-safe finding text using publicText where set, title as fallback, with severity emoji labels. deep adds action hints for findings that carry publicText. All text is sanitized by a new sanitizeForCheckRun() that strips reward, wallet, hotkey, trust score, reviewability, scoreability, farming, and related terms.
• src/github/app.ts — Added CheckRunOutcome discriminated union (published | permission_missing). createOrUpdateCheckRun now accepts detailLevel, wraps Octokit calls in try/catch, and returns { kind: "permission_missing" } on 403 or message-matched permission errors instead of throwing. Non-permission errors still rethrow. Default detailLevel is "minimal" so all existing callers are unaffected.
• src/queue/processors.ts — Passes settings.checkRunDetailLevel to createOrUpdateCheckRun. Passes the real advisory (with findings) instead of the previous hard-coded empty-findings override. Handles permission_missing by recording a github_app.check_run_permission_missing audit event rather than silently succeeding.

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint — skipped (no workflow files changed)
• npm run typecheck
• npm run test:coverage — 857 tests pass, branch coverage 97.02% (above threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• npm run actionlint — no workflow files were modified.
• npm run test:workers, build:mcp, test:mcp-pack, ui:* — no MCP package or UI files were changed.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics. sanitizeForCheckRun() strips all forbidden terms; tests assert output never matches the forbidden-terms pattern at every detail level.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — N/A; no auth changes. The permission-missing path is tested with a 403 and a 422 message-based case.
• API/OpenAPI/MCP behavior is updated and tested where needed. — check-run creation/update paths tested; permission_missing outcome tested end-to-end.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. — N/A, no UI changes.
• Visible UI changes include screenshots or a short recording. — N/A, no UI changes.
• Public docs/changelogs are updated where needed. — N/A, internal GitHub App behavior only.

Notes

• formatCheckRunOutput default remains "minimal" — all call sites that don't pass detailLevel are unaffected. The processors.ts caller now passes settings.checkRunDetailLevel, so behavior is controlled entirely by the per-repo setting.
• The permission_missing audit event (github_app.check_run_permission_missing) is recorded with outcome: "error" and the warning text, giving operators a clear signal to fix the GitHub App permission without a noisy exception in the job queue.
• findings in the advisory are now passed through to formatCheckRunOutput rather than being cleared. The sanitizer and publicText-first selection ensure no private finding details reach the check-run output.

[JSONbored]

@enjoyandlove this is in good shape.

A few notes:

• The check-run output stays on the public-safe side of the boundary instead of leaking review-only detail.
• Permission and validation failure paths are handled explicitly, which is the right shape for GitHub App behavior.
• The tests cover the key sanitizer and check-run failure cases.

No code changes requested.

Validation expected:

• Keep the current CI/check-run suite green through merge.