[codex] Track pending GitHub check suites

[Chener]

Summary

• Persist non-completed GitHub check_suite webhook deliveries instead of dropping them.
• Let existing PR check aggregation surface queued/in-progress suites as pending until a later completed suite updates the same row.
• Add webhook coverage for pending -> passed CI state transitions on linked issue PRs.

Why

The PR/CI sidebar already had a pending display path, but the webhook handler only stored completed check suites. That meant Multica could show passed/failed CI after completion, but not an actively queued or running CI state from GitHub.

Agent-assisted follow-up layer

This PR keeps the deterministic status data in Multica's backend: PR open/draft/merged/closed state, mergeability, and CI pending/passed/failed should be synchronized cheaply and reliably without waking an agent for every GitHub event.

The agent route is still useful, but it should sit above the structured sync layer and only fire when human-readable interpretation is needed, for example failed/cancelled CI, merge conflicts, or review feedback that needs a concise issue comment. That follow-up layer should be deduped/throttled by PR + head SHA + reason so repeated webhook deliveries do not spam comments or agent runs.

In short: backend sync is the source of truth for status; agents are for explaining actionable exceptions in plain language.

Deployment / Configuration

Deployments still need the existing GitHub App webhook setup with GITHUB_WEBHOOK_SECRET configured. The GitHub App should subscribe to check_suite events in addition to pull request events so queued/in-progress/completed suite deliveries reach /api/webhooks/github.

Validation

• go test ./internal/handler -run TestWebhook_CheckSuite_PendingEventAggregates
• go test ./internal/handler -run TestWebhook_CheckSuite_AggregatesAcrossApps
• go test ./internal/handler -run TestWebhook_CheckSuite_OldHeadIgnored
• go test ./internal/handler
• go test ./pkg/agent -run TestOpencodeBackendAnchorsDirAndPWD -count=1
• go test ./pkg/agent -run TestOpencodeBackendQuestionDenySurvivesUserConfig -count=1
• go test ./pkg/agent -run TestKiroBackendInvokesACPWithTrustAllTools -count=1
• go test ./pkg/agent -run TestCodexExecuteSemanticInactivityAllowsContinuousDeltaProgress -count=1
• go test ./pkg/agent -run TestCodexExecuteSemanticInactivityAllowsContinuousMessages -count=1
• go test ./pkg/agent -run TestCodexExecuteTimesOutWhenTurnStopsAfterToolResult -count=1
• git diff --check

go test ./... was also attempted. It still fails in server/internal/daemon/repocache at TestCreateWorktreeInstallsCoAuthoredByHook because the test commit message lacks the expected Co-authored-by trailer; that failure is unrelated to this webhook change and reproduces when run directly.

[vercel]

Someone is attempting to deploy a commit to the IndexLabs Team on Vercel.

A member of the Team first needs to authorize it.