feat(ci-status): advisory checks from ci.ignore in .reeve/policy.yml (RV-74)

[devondragon]

Summary

The finish step parked on any red check, so when GitHub's Copilot code review failed on its own side (2026-09-29, every reeve-sandbox PR) every autonomous run parked before Reeve saw the PR. Reeve's gate now accepts an advisory list, ci.ignore in .reeve/policy.yml (devondragon/reeve#188). This makes ccmagic follow the same rule.

• bin/ccm-ci-status: when a check is not passing, it reads .reeve/policy.yml from the PR's base branch through the contents API (never the working tree, which is the PR head) and sets aside each check ci.ignore names, by exact name (check run name or status context). A listed failure or pending check neither fails nor holds the result; an unlisted failure still does. An entry's app or creator is checked against the check-runs or statuses API; when that read is refused (HTTP 403 for a fine-grained token) the check is set aside by name with owner_unverified: true, since Reeve checks the App again before it merges. New output fields: advisory (the set-aside checks that had not passed) and policy_note (why nothing was set aside, when the policy could not be read or parsed, or lists a check under both ci.required and ci.ignore). With only advisory checks left, the result is decided as if no check had reported. A green PR makes no policy read.
• Actions fallback (Cyrus sessions, whose fine-grained token gets 403 on check runs): a run that is not passing is replaced by its jobs (actions/runs/{id}/jobs), whose names are the check-run names and whose App is github-actions, so { name: copilot-pull-request-reviewer, app: github-actions } sets aside only that job. A whole workflow run never matches an entry.
• bin/ccm-lib.sh: ccm_policy_ci_json reads the policy's ci.required and ci.ignore (block form only, flow or block entries, quoted commas kept in values; anything else sets nothing aside). Checked under BSD awk, mawk, and gawk.
• Because ccm-merge-gate, the merge guard hook, finish-ticket, and auto-ticket's CI wait all go through ccm-ci-status, they all follow the rule. finish-ticket and auto-ticket get one sentence each saying advisory checks are not failures; tests/every-ticket-since-baseline.diff is regenerated for those lines.
• CHANGELOG entry under [Unreleased]. No version bump and no release in this PR.

Tests

bash tests/run.sh: 451 passed, 0 failed. New: a failed advisory check with a green check is green and the policy is read with ref=main; an unlisted failure still fails; a pending advisory check is not waited on under --watch; a same-named check from another App is counted; a 403 on check runs sets it aside as owner_unverified; status creator binding; no policy, an overlapping policy, and an unparseable list set nothing aside; only advisory checks leads to not-registered; a green PR reads no policy; ccm-merge-gate passes with a failed advisory check. shellcheck -x as CI runs it is clean.

Known differences from Reeve

Reeve is the final gate, so where ccmagic is looser Reeve still parks:

• A name-only entry may also match a status of that context here; Reeve matches check runs only.
• ccmagic does not validate the rest of the policy; a policy Reeve rejects for another reason sets nothing aside in Reeve.
• A passing advisory check is not set aside here, so a head whose only check is a passing advisory one reads green here and waits in Reeve.