github: Implement ChecksByChange with per-run detail and checks URL

[ed-irl]

Implements the GitHub side of the per-change checks API: rollup
state, per-run name/state/url for both CheckRun and StatusContext
nodes, and the PR's checks summary page URL.

• Per-PR GraphQL query over PullRequest.commits(last:1).
  StatusCheckRollup gives us the rollup state and the contexts
  connection (capped at 50 per PR; pagination not yet needed).
• rollupFromStatusCheckRollupState collapses the StatusState enum
  to the upstream rollup taxonomy. Empty input -> ChecksNone
  distinguishes 'no checks' from 'all passed'. Unknown states
  fall back to ChecksFailed.
• nativeCheckRunState lower-cases CheckRun.conclusion when status
  is COMPLETED, otherwise CheckRun.status. nativeStatusContextState
  lower-cases StatusContext.state. Forge-native vocabulary is
  preserved in runs[] so future UI surfaces can distinguish
  neutral/cancelled/skipped/timed_out without an upstream API
  change.
• PullRequest.permalink + '/checks' provides the click target.
• ChangeChecksState (merge handler) gets a small refactor onto
  the new rollup helper without changing its existing 'no rollup
  -> passed' semantics.

ChecksByChange issues one query per PR. Batched-via-aliases would
be sharper for tall stacks but is awkward in shurcooL/githubv4;
the per-PR queries are cheap relative to the rest of gs ll.

Integration fixtures regenerate on the next forgetest -update
pass (real GH credentials).

[ed-irl]

This change is part of the following stack:

• restack: Add Options parameter to high-level restack entry points #1307
  • forge: Add ChecksByChange and ChecksNone for per-change checks output #1263
    • shamhub: Implement ChecksByChange with full rollup + runs + URL seeding #1264
      • github: Implement ChecksByChange with per-run detail and checks URL #1265 ◀
        • gitlab: Implement ChecksByChange with per-job pipeline detail #1266
          • bitbucket: Implement ChecksByChange with per-status build detail #1267
            • list: Emit per-change forge checks via --cr-checks JSON flag #1268
              • docs: Document forge checks JSON output and add changelog entry #1269

_{Change managed by git-spice.}