Fix duplicate required check identity handling

[coygeek]

Summary

• Preserve check run vs commit status identity when reducing status-check rollup entries.
• Aggregate same-name required contexts fail-closed so failed entries block and pending entries wait.
• Add regression coverage for passing check runs paired with failed or pending same-name commit statuses.

Closes #17

Validation

• PYTHONPATH=src python3 -m pytest tests/test_cli.py -q
• PYTHONPATH=src python3 -m pytest -q
• PYTHONPATH=src python3 -m ruff check src tests
• PYTHONPATH=src python3 -m unittest discover -s tests -v
• PYTHONPATH=src python3 -m build
• autoreview --mode local: clean, no accepted/actionable findings

[mberman84]

Requesting changes for a regression against current main's exact-commit fallback. Please normalize check identity consistently across the GraphQL rollup and REST check-run feeds (or let exact data replace the corresponding rollup entry), add coverage for a stale pending rollup plus a successful exact check, and compose this with #21's PASSED_CHECK_STATES. GitHub CI is still action_required; re-request review after updating the head.

[mberman84]

statusCheckRollup CheckRun entries use workflowName, while commit_check_runs() REST entries use app.slug. The exact-check fallback concatenates those feeds, so one CI run becomes two identities: a stale pending rollup plus an exact successful REST run still reduces to pending. Normalize a stable identity across both shapes, or replace the rollup identity with exact data, and add that regression case.

[coygeek]

Addressed the review feedback in the updated head. The exact-check fallback now treats rollup CheckRun data and REST exact CheckRun data for the same named run as the same CheckRun identity, while still evaluating same-name commit statuses separately as GitHub requires. Added regression coverage for the stale rollup plus exact REST CheckRun case.

Verification: PYTHONPATH=src uv run --with pytest --with ruff python -m pytest tests/test_cli.py -q and uv run --with ruff ruff check src tests both pass.

[mberman84]

Re-reviewed after rebasing onto #21. The reducer now keeps separate CheckRun/status identities while accepting SUCCESS, SKIPPED, and NEUTRAL only when every retained identity passes. Full suite: 222 passed, 3 skipped, 202 subtests; Ruff clean; structured autoreview clean.