Bound GitHub drain operations

[jmcte]

Summary

• add abortable, retry-aware GitHub requests with one overall drain deadline
• retry transient GET/DELETE responses while respecting Retry-After, without blindly retrying token POSTs
• bound shell curl and embedded GitHub App token requests
• track runner registration IDs, delete same-name replacements, and require consecutive absence observations
• expose a quiesce callback contract for the lifecycle integration packet

Validation

• pnpm exec vitest run test/github.test.ts test/drain.test.ts test/cli.test.ts (93 tests passed)
• CI=true bash scripts/ci/run-fast-checks.sh (48 files, 268 tests; lint and build passed)
• bash -n scripts/lib/github-runner-common.sh
• git diff --check

Synology / GitHub Impact

• no deploy impact
• compose/config change
• image rebuild or republish required
• GitHub settings or runner-group change required

This is a mergeable prerequisite for #152 and #155, not their final closure. The follow-up integration must wire plane-specific service/worker quiescence into the new callback and bound remaining CLI, SSH, SCP, repository, workflow, and container-package operations before those issues close.

Refs #152
Refs #155

[athena-omt]

Governance review: I refreshed the branch first because it was behind; live head 11dcf63 has now completed fresh CI successfully, and auto-merge is already enabled.

I reviewed the bounded GitHub request wrapper, drain deadline/retry behavior, stable absence handling after runner deletion, shell curl/API timeouts, and updated tests. I did not find a blocker.