fix(github): grant read access to commit statuses

[tlgimenes]

Studio requests statuses: read for repository-scoped GitHub tokens, but the GitHub MCP issuer rejects that permission and Studio falls back to a narrower token. Reading a PR’s combined CI rollup can then fail with Resource not accessible by integration, including when publishing encounters a previously merged PR.

Allow commit-status access, cap it to read-only, and include it in refresh upgrades. If an installation has not approved status access, drop that optional upgrade first while retaining approved checks and deployment access. Update the tool description and permission documentation.

Validation:

• 136 GitHub MCP tests passed, including status write capping, legacy grant upgrades, and permission-refusal fallback without revocation.
• GitHub MCP and repository-reports type checks passed.
• Production bundle dry run passed.
• Repository formatting and lint hooks passed; lint reported warnings outside the changed files.

Existing eligible grants acquire status access on refresh after deployment; no storage migration is required.

---

Summary by cubic

Fixes 403 "Resource not accessible by integration" errors when reading a PR's combined CI rollup (including for already-merged PRs) by granting commit-status read access to repository-scoped GitHub tokens.

• Adds statuses: read to the minted token's permission set, capped read-only to prevent forging CI signals.
• Adds statuses to the refresh upgrade ladder, so existing grants pick it up on their next refresh without re-import or migration.
• If an installation refuses status access, the refresh falls back to the previously approved permissions, retaining checks and deployments access.

^{Written for commit 84ef8c8. Summary will update on new commits.}