Harden PR workflow support

[pengfei-threemoonslab]

Summary

Implements the Phase 2 PR workflow hardening plan for Agents Shipgate.

• Adds a shared PR projection layer used by GitHub Actions annotations and Check Run annotations.
• Adds check_run_policy with advisory, blocked-fails, and require-mergeable modes for branch-protection-ready Check Runs.
• Updates init --ci to generate a PR-first advisory workflow with fetch-depth: 0, diff_base: target, annotations, and PR comments.
• Improves PR comment and step-summary projection so PR surfaces lead with merge verdict, mergeability, next action, counts, and artifacts.
• Keeps the verifier command contract stable by reverting the cosmetic --json to --format json churn in agent-facing docs/renderers.
• Updates the Check Run example/docs for the unreleased check_run_policy input and documents blocked-fails explicitly.
• Deduplicates capability-change annotations when the same related finding is already selected for the same PR projection.
• Adds focused tests around generated CI, annotation projection, Check Run policy mapping, Action metadata, public contracts, and step summaries.

Review fixes addressed

• Cursor whole-file managed rule regression: removed the renderer/content change, so no PRIOR_RENDER_SHA256 migration is needed.
• Command-contract drift: dropped the behavior-neutral verifier flag churn instead of claiming --json changes output semantics.
• Version-pinned example: 10-check-run-annotations.yml now targets @main and omits shipgate_version until a release contains check_run_policy.
• blocked-fails policy: documented in the Check Run mapping contract and GitHub Actions examples.
• Duplicate annotations: related capability-change rows are skipped when their finding has already been selected.

Validation

• PYTHONPATH=src python -m pytest tests/test_github_action_annotations.py tests/test_github_check_run.py tests/test_action_metadata.py tests/test_init_ci.py tests/test_public_surface_contract.py tests/test_adapter_static_only.py tests/test_verify.py -q -> passed
• PYTHONPATH=src python -m pytest -> 3137 passed, 5 skipped
• PYTHONPATH=src python -m ruff check . -> passed
• PYTHONPATH=src python -m compileall -q src tests scripts -> passed
• git diff --check -> passed
• AGENTS_SHIPGATE_AGENT_MODE=1 PYTHONPATH=src python -m agents_shipgate check --agent codex --workspace . --format agent-json -> decision=allow
• AGENTS_SHIPGATE_AGENT_MODE=1 PYTHONPATH=src python -m agents_shipgate verify --workspace . --config shipgate.yaml --base origin/main --head HEAD --ci-mode advisory --format json -> merge_verdict=mergeable, can_merge_without_human=true, release_decision=passed