feat(seer): Add failing check run URLs to autofix overview API

[NicoHinderling]

Summary

The Autofix Overview page shows a "N Checks Failing" pill whose tooltip lists each failing PR check by name. Those names are dead text — there's no way to jump from a failing check to its CI run.

This backend change captures each failing check's run URL from GitHub and exposes it on the autofix-overview API so a follow-up frontend PR can link each check to its run.

What changed

• GitHub GraphQL (pull_request_status.py): fetch detailsUrl on CheckRun nodes (the external run page) and targetUrl on legacy StatusContext nodes.
• PullRequestStatusResult.failed_checks: now a tuple of a new FailedCheck(name, url) dataclass instead of bare strings. URL is None when the provider doesn't give one.
• API payload: adds a new failedCheckDetails: [{name, url}] field on PullRequestPayload.

Deploy safety

Frontend and backend don't deploy atomically. Rather than change the shape of the existing failedChecks: string[] field (which would make the currently-deployed frontend try to render objects as text and crash the tooltip during the deploy window), this adds failedCheckDetails and leaves failedChecks untouched. The follow-up frontend PR reads the new field; a later cleanup PR can drop failedChecks once the frontend is out.

Tests

• Extraction unit tests cover check-run detailsUrl, status-context targetUrl, and null URLs.
• Serializer tests assert both failedChecks (names, unchanged) and the new failedCheckDetails.

All affected backend suites pass; prek + mypy clean.

Security

The check url is provider/CI-controlled (StatusContext.targetUrl is set by third-party CI apps), and Sentry's frontend link primitives don't sanitize the URL scheme. To prevent a javascript:/data: link from becoming a DOM-XSS sink once the frontend renders it as an anchor, FailedCheck enforces an http(s)-only invariant at construction — any other scheme (or a non-string) becomes None.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit ae2991b. Configure here.}