Prevent stale GitHub Actions run state

[mdotk]

Summary

• use a dedicated uncached Octokit client for GitHub Actions run state
• strip conditional validators and send Cache-Control: no-cache on the runs-only client
• retain ETag caching for repository and workflow metadata
• replace octokit.paginate() in fetchActiveWorkflowIds() with explicit page reads so cached workflow metadata is not mutated
• update the production qs dependency to the fixed release and apply non-breaking dev-toolchain audit fixes

Root cause

The dashboard could keep a completed or failed run displayed as queued or in_progress after GitHub had reached a final conclusion.

Live tracing showed two contributing paths:

1. Actions-run state must not use conditional responses because stale transition bodies are unsafe for a status dashboard.
2. octokit.paginate() mutated the ETag-cached workflow-list response. The first request returned the correct active workflow IDs, but subsequent 304 responses produced an empty ID set. That caused every fresh run to be filtered out while the previous dashboard cache remained visible.

The patch isolates volatile Actions-run requests on an uncached client while keeping metadata caching. Explicit workflow pagination preserves the cached response object.

Security and dependencies

• no new outbound destinations; runtime requests remain limited to api.github.com
• no token logging or persistence changes
• qs resolves to 6.15.3, fixing GHSA-q8mj-m7cp-5q26
• npm audit --omit=dev reports zero vulnerabilities
• the remaining full-tree finding is a low-severity Windows esbuild development-server advisory reached through the tsup build tool; esbuild is not in the production dependency tree

Validation

• npm run fmt:check
• npm run lint
• npm test: 109 tests passed
• npm run build: server and client builds passed
• repeated ETag regression: active workflow IDs remained intact across three consecutive 304 cache hits
• live acceptance: one run changed from in_progress to completed/failure and another to completed/success without restarting the dashboard process

Fixes #4