Fix: verify reports checks failing when CI is green (mergeable_state mapping)

[ermin-muratovic]

Summary

cforge-dev verify reports 'All checks must pass before merge' even
when GitHub Actions CI is fully green.

Root Cause

OctokitGitHubClient.getPullRequest maps mergeable_state to checksPassing:
'clean' → true
anything else → false

GitHub does not always return 'clean' immediately after checks pass.
Other valid states when checks are green:
'unstable' — checks passed but branch is behind main
'has_hooks' — checks passed, webhooks pending
'blocked' — missing required reviews (not a CI failure)

Fix

Change the checksPassing mapping strategy:
Instead of relying on mergeable_state, call the GitHub Checks API
directly to get actual check run conclusions:

octokit.checks.listForRef({
owner, repo,
ref: pr.head.sha,
filter: 'latest'
})

checksPassing = all check runs have conclusion 'success'
This is the authoritative source — not mergeable_state.

Acceptance Criteria

• verify correctly reports ready when CI checks are success
• verify correctly blocks when CI checks are failure
• mergeable_state no longer used for checksPassing determination
• Existing tests updated to mock checks API
• Manual test: verify passes after --auto opens PR with green CI

Type

BUG