fix: surface CI ingest failures in the PR comment

[veksen]

When POST /ci/runs fails, the run is computed but never saved — previously that produced a degraded PR comment that looked like a normal empty result plus a green check, so the failure silently vanished. This branch surfaces the failure prominently and tailors both the comment copy and the Actions severity to the cause:

• auth (401/403) — the project token is missing/invalid; CI isn't really running. Fails loudly (setFailed).
• transient (network/timeout/5xx) — recoverable; warns and suggests a re-run.
• too_large (413) — the payload exceeded the API's size limit. Distinct from rejected: it's a size issue, not contract skew, so the "out of sync" copy would be wrong. Re-running won't help.
• rejected (other 4xx) — the API refused a computed run (likely analyzer/API contract skew); our bug, non-blocking unless FAIL_ON_INGEST_ERROR.

The raw error body is echoed (truncated) into a Details block in the comment. Tests cover the classifier and each rendered banner.

Pairs with Query-Doctor/Site #3488 (raise the ingest body limit to 10mb) and #3489 (return a typed payload_too_large 413).

🤖 Generated with Claude Code

[github-actions]

Query Doctor Analysis

3 queries analyzed

0 regressed · 0 improved · 0 new · 0 removed

2 pre-existing issues

• SELECT "guests"."id", "guests"."session_id", "guests"."username", "guests"."avatar_path", "guests"."color", "guests"."side", "guests"."audio_recording_path", "guests"."audio_recording_public", "gue...
  index assets(event_id, inserted_at desc)
  cost 31,003,449 → 1,498 (100% reduction)
• SELECT * FROM guest_ip_addresses WHERE ip_address = '127.0.0.1';
  index guest_ip_addresses(ip_address)
  cost 154,402 → 8 (100% reduction)

_{Using assumed statistics (10000000 rows/table). For better results, sync production stats.}

_{More detail → get_ci_run({ runId: "019f2d4e-eda2-7a47-8093-6411a072db60" }) · view run · docs}