GitHub triggers wake agents on CI results

A GitHub trigger now fires on workflow_run and check_suite completions, with a normalized github.ci context for the message and each workflow as its own subject. New agent GitHub Apps request read access to actions and checks; the agent’s GitHub card lists what an older App is missing.

Turn on Only when the CI result changes in the GitHub trigger form to wake the agent only when the outcome for a workflow and branch changes, for example from passing to failing, instead of on every run. Triggers expose this as the changes_only filter.

See Agent triggers, Summarize GitHub pull requests and #4541, #4546.