[DEV-76] CI failure watcher acquirer: auto-fix failing checks on the agent's own PRs

[danii1]

Summary

Implements DEV-76: a new worker acquirer that watches CI on the agent's own PRs and automatically re-runs the agent to fix failing checks.

What was built

New acquirer — packages/code/src/lib/ci-failure-watcher-acquirer.ts

• Tier 1 poller over the agent_prs registry: ETag-cached conditional GETs on the PR (unwatch closed/merged), head-SHA check runs, and combined commit statuses
• Acts only on terminal failure conclusions; fork PRs skipped quietly; dedupe per headSha + checkRunId under source github:ci via queue.hasProcessed/markProcessed (survives restarts)
• Retry cap per PR (CI_FIX_MAX_ATTEMPTS, default 3) persisted in a new ci_fix_state table in WorkerState; exhaustion posts an escalation comment once and blocks until the head moves; fully-green CI resets the budget (mixed results don't refund it)
• truncateCiLogs(): strips ANSI, keeps error-marker windows across the whole log plus a tail window, caps at ~16k chars

GitHub client — github-reviews.ts: getCheckRuns, getCombinedStatus, getWorkflowRunJobs, getWorkflowRunsForSha, getJobLogs (null on 403/404), getCheckRunAnnotations (log fallback)

Fix pipeline — address-review.ts gained --ci-feedback <file> mode: reads watcher-written JSON (CiFailureFeedback from review-formatter.ts), begins a run with origin ci_fix, then reuses the existing worktree prep, sandboxed agent spawn, commit/push-with-hook-retries flow verbatim. Also fixes a dangling in-progress run when the agent makes no changes. CLI spawn helper: runCiFixViaCli.

Run recording/dashboard — "ci_fix" added to RunOrigin, stats byOrigin, dashboard-api filter validation, and dashboard-ui types/filters/stats hint.

Wiring — registered in single-repo worker (index.ts) and fleet mode (workspace-worker.ts → new createFleetCiFix in fleet-events.ts), gated on GitHub creds like the review poller.

Tests — tests/ci-failure-watcher-acquirer.test.ts (15 tests) + truncation unit tests + formatCiFixPrompt tests. All gates pass: 809 tests (0 fail), typecheck, lint, format. Docs updated in docs/code/worker.md.

[danii1]

Superseded by #127, which ports DEV-76 onto current main and incorporates the correctness, continuous-watch, workspace toggle, retry, serialization, and GitHub permission updates found during review.