[DEV-76] Auto-fix CI failures on DevIntern-created PRs

[danii1]

Summary

• continuously watch GitHub Actions workflow runs and commit statuses on open DevIntern-created PRs
• run bounded CI repair attempts through the existing address-review pipeline
• add an opt-in, live-reloadable [workspace].ci_failure_fix setting (default: false)
• keep pending, failing, and not-yet-reported CI on the configured cadence while progressively backing unchanged green PRs off to 5, 15, and 30 minutes
• record CI repair runs in the dashboard and persist retry/escalation state across restarts
• support fine-grained PATs with the available Actions and Commit statuses read permissions

Replacement for #51

This ports DEV-76 onto the current main after the original PR became stale and conflicted. It also fixes issues found during the review of #51:

• uses the GitHub Actions job-log endpoint instead of a nonexistent logs_url
• does not reset the retry budget while any workflow remains pending
• only deduplicates a failure after a successful fix invocation, allowing failed/no-op runs to retry
• preserves workflow/status failure snapshots across conditional 304 responses
• serializes CI repair with review handling for the same PR
• avoids escalating immediately after a successful repair push while GitHub still reports the old head
• reduces steady-state API traffic with per-PR adaptive polling

Watch lifecycle

The watcher reconciles once at worker startup. Pending, failing, changed, and not-yet-reported CI is polled at the configured workspace interval. Once a PR is terminal green and remains unchanged, that PR progressively backs off to 5, 15, and 30 minutes; an observed PR or CI change restores the configured cadence. Green PRs continue to be checked so delayed reruns and newly added workflows are detected.

It watches only open PRs in the local agent_prs registry and stops when the PR closes, the repository is removed, the feature is disabled, or the worker stops. Retry/escalation state survives worker restarts; a restart performs an immediate reconciliation.

Configuration

[workspace]
ci_failure_fix = true

The setting defaults to false and live-reloads.

GitHub permissions

When enabled, the local token or customer-owned GitHub App needs:

• Actions: Read
• Commit statuses: Read

Existing customer-owned App installations must be re-approved after these permissions are added.

GitHub does not currently expose its separate Checks permission for fine-grained PATs. GitHub Actions is therefore detected through the Actions API, which provides run/job conclusions and logs with Actions: Read. CI providers that publish only Checks API check runs are outside this version's watch scope unless they also publish a legacy commit status.

Validation

• merged current main and resolved the fleet runner contract conflict
• @getdevintern/code: 1,393 tests passed
• @devintern/dashboard-ui: 100 tests passed
• adaptive polling coverage: progressive 5/15/30-minute backoff, fast reset on change, and fast polling for pending/absent CI
• format, lint (0 errors), typecheck, full monorepo build, and pre-push suite passed

[danii1]

Updated after the fine-grained PAT review: CI detection now uses the Actions API (workflow runs, jobs, and job logs) plus legacy commit statuses, with no Checks API dependency. Also merged current main and resolved the fleet runner return-type conflict.