Close ResearchRun recovery and harden provider evidence

[2002yy]

What changed

• close chat-owned ResearchRun cancellation, recovery, next-turn source consumption, and same-run EvidenceTrail behavior
• add Provider cache schema v1 / SQLite schema v16 and persist immutable checks, change-impact, and review-context evidence
• follow nested GraphQL cursors for comments inside pull-request review threads
• keep per-thread comment counts, pagination, truncation, cursor stop reasons, and provider errors explicit
• share one request budget across outer REST/GraphQL collections and nested comment pages
• resolve cross-fork checks against the head repository first, then fall back to the base repository only while shared budget remains
• report checks candidate repositories, attempt order, request use, errors, and final evidence owner
• refresh docs/PROJECT_STATUS.md

Why

Review-thread pagination previously stopped after the first embedded comments page. Cross-fork checks also queried the base repository before the fork that owns the head SHA, wasting request budget and sometimes missing the real evidence. These changes make pagination and repository ownership explicit and bounded.

Safety contracts

• nested pages cannot exceed either the per-collection page limit or the composed request limit
• a missing cursor reports provider uncertainty without consuming a request
• fork checks use the immutable head SHA and one shared budget across candidate owners
• failed candidate details remain visible even when a fallback repository succeeds
• moving refs and changing review/CI evidence continue to invalidate persistent cache keys

Validation

• nested review/checks/review-context focused suite: 15 passed
• GitHub-related regression suite: 92 passed
• full Ruff passed
• previous head passed both push and pull-request CI; latest head requires a fresh CI pass