feat: add GitHub Check Runs for deployment authorization PR visibility

GitHub Deployments only appear in the PR Environments section. This adds
Check Runs via the Checks API so blocked deployments show a prominent
yellow "action_required" badge in the PR checks list. On authorization,
the check run is updated to green success.

Author: Flo4604

svc/ctrl/worker/github/interface.go

@@ -38,12 +38,6 @@ type GitHubClient interface {
 	ListCheckRunsForRef(installationID int64, repo string, ref string, checkName string) ([]CheckRun, error)
 }
 
-// CheckRun holds the minimal fields of a GitHub Check Run needed for updates.
-type CheckRun struct {
-	ID   int64
-	Name string
-}
-
 // CommitInfo holds metadata about a single Git commit retrieved from the GitHub API.
 type CommitInfo struct {
 	SHA             string
@@ -53,6 +47,12 @@ type CommitInfo struct {
 	Timestamp       time.Time
 }
 
+// CheckRun holds the minimal fields of a GitHub Check Run needed for updates.
+type CheckRun struct {
+	ID   int64
+	Name string
+}
+
 // InstallationToken represents a GitHub installation access token. The token
 // provides repository access for a specific App installation and expires after
 // 1 hour.