Resolve Check Run head SHA and target ref correctly

[romgenie]

Local source: coven-github/issues/05-resolve-check-run-head-sha-and-target-ref.md

Summary

Check Runs should be created against the exact commit SHA being reviewed. The worker currently uses a "HEAD" placeholder when creating the Check Run, which is not a reliable GitHub commit target.

Current Evidence

• crates/worker/src/lib.rs calls Check Run creation with "HEAD" and includes a TODO to resolve the head SHA.
• docs/hosted-mvp-plan.md explicitly lists resolving head SHA instead of using HEAD for Check Runs.
• The current V1 task envelope covers issue and review-comment tasks but does not consistently carry a target commit SHA.

Problem

GitHub Check Runs are attached to a commit SHA. If the adapter uses "HEAD" without resolving it to a real target, checks can fail to create, attach to the wrong object, or become ambiguous across branches and PR updates.

Impact

• Maintainers may not see the agent check on the intended PR commit.
• A stale task can publish a result against a newer or different commit.
• Revalidation cannot prove findings correspond to the reviewed diff.
• Audit records cannot tie the agent output to immutable code.

Proposed Design

Extend event parsing and task creation to capture target refs:

• issue tasks: default branch SHA at task start, plus issue metadata;
• PR review-comment tasks: PR number, PR head SHA, base SHA, comment path/position if available;
• PR lifecycle tasks: PR number, head SHA, base SHA, action;
• push/commit tasks: before/after SHA and commit range.

The worker should create Check Runs with the immutable head_sha from the task. Before publishing results, it should re-fetch the target and decide whether the task is still current.

Acceptance Criteria

• No Check Run creation path uses the literal string "HEAD".
• Task records include target ref fields appropriate to the trigger kind.
• PR tasks attach checks to the PR head SHA.
• Push/commit tasks attach checks to the pushed commit SHA.
• Stale tasks are marked stale or superseded rather than publishing against the wrong ref.
• Tests cover issue, PR review comment, PR lifecycle, and push target resolution.

Test Notes

Add fixture payloads for GitHub issue, pull request review comment, pull request synchronize, and push events. Assert that parsed tasks include correct SHA/ref data and that Check Run requests use those exact values.