Fix protected GitHub run waiting diagnostics

[shiny-code-bot]

Summary

• add a native cross-platform gh_run_wait tool that detects GitHub Actions waiting status immediately
• inspect exact-run pending deployments and report environment approval capability without mutating approvals
• enforce one bounded deadline across run selection, polling, and active gh commands, with process-group cleanup and reaping
• harden the shell fallback with exact --commit selection, bounded commands, signal cleanup, and regression coverage

Root cause

The previous generic waiter treated status=waiting as ordinary nonterminal progress. It never queried pending_deployments, so a protected-environment approval could remain invisible until an operator noticed the stalled run manually.

Validation

• bash scripts/tests/wait-for-gh-run-test.sh
• cargo test -p codex-core gh_run_wait
• ./build-fast.sh