feat(github): idempotent per-item stage-report GitHub comments (#433, #442)

[wesleysimplicio]

Summary

Closes #433, Closes #442.

• [P0][Stage Agents][GitHub Reporting] Reportar cada item, agente e transição do fluxo por comentários idempotentes #433 (epic [EPIC][P0][Portable Stage Agents] Materializar agentes concretos em cada etapa do simplicio-loop em qualquer runtime #422, "Portable Stage Agents") asks for a living, per-work-item GitHub comment
  covering the FULL lifecycle (discovered -> claimed -> intake/planning -> implementation ->
  safety -> review A/B/C -> delivery/PR/checks/merge -> feedback/retry/recovery -> final audit ->
  COMPLETE|PARTIAL|BLOCKED|REGRESSED), posted on both the source issue and the PR, extending (not
  replacing) [P1][Feedback][Entrega] Instrumentar web_verify/video_evidence/pr_evidence, secao de progresso no PR e comentario idempotente de progresso na issue #301's single progress-comment scope.
• [P0][GitHub] Publicar progresso canônico em Issues/tasks e PRs #442 ("nasce da execução da [P0][Stage Agents][Contract] Definir manifesto, lifecycle, identidade e receipts tipados por etapa #423") narrows the envelope/identity/idempotency-key details: agent
  identity Nome/Papel - #XXXX - Modelo (4-char abbreviated hostname), idempotency key
  run_id + item + stage + attempt + transition, explicit PASS/REGRESSED/BLOCKED/NEEDS-HUMAN
  status tags, cross-links between issue/PR/commit/evidence, and a stable marker for
  find-and-update.

This PR implements both in one coherent module, simplicio_loop/stage_report.py, rather than
two overlapping mechanisms:

• hostname_abbrev / format_agent_identity — Name/Role - #XXXX - Model, #XXXX being the
  4-char abbreviated hostname (never an issue number), so the same model/role reads distinctly
  across machines ([P0][GitHub] Publicar progresso canônico em Issues/tasks e PRs #442 requirement 6).
• idempotency_key(run_id, item, stage, attempt, transition) — stable across retries, exactly
  [P0][GitHub] Publicar progresso canônico em Issues/tasks e PRs #442's spec.
• build_marker(run_id, item) — one stable per-work-item HTML marker
  (<!-- simplicio-loop:stage-report:v1 run=<run_id> item=<item> -->) so the SAME comment is
  updated across the entire lifecycle, on either an issue or a PR (PRs are addressed via the same
  GitHub issue-comments endpoint).
• render_stage_report — deterministic, sanitized (secrets/signed-URLs redacted), length-capped
  envelope with cross-links (issue/PR/commit), the four explicit status tags, stages/AC tables,
  blockers, evidence, and next-gate sections. Rejects any status outside
  PASS/REGRESSED/BLOCKED/NEEDS-HUMAN.
• publish_stage_report — publishes via an injected publish_comment_fn
  (scripts.pr_evidence.publish_comment, the same fail-closed, marker-based, no-shell-
  interpolation primitive feat(github): implementar adapter transacional do ciclo de vida das issues com comentário único e idempotente #285/[EPIC][P0] Tornar o simplicio-loop production-grade: planejamento profundo, multi-device, multi-LLM e zero falso “done” #295/[P1][Feedback][Entrega] Instrumentar web_verify/video_evidence/pr_evidence, secao de progresso no PR e comentario idempotente de progresso na issue #301 already hardened) using the item's marker. This is the
  fix for the adversarial-review bug class flagged in the task: the idempotency check
  (find_existing_comment) is exercised by the real publish path itself
  (publish_stage_report -> publish_comment_fn(..., marker=...) -> find_existing_comment),
  not just a standalone unit-tested helper — proven directly in
  tests/test_stage_report_unit.py::test_publish_stage_report_updates_same_id_on_retry_no_duplicate
  and the CLI's own selftest. Also re-queries and confirms the observed body hash, mirroring
  github_lifecycle.publish_lifecycle_state.
• scripts/stage_report.py — CLI (preview / publish / selftest), dry-run friendly
  (--dry-run or simply omitting both --issue/--pr), fail-closed on any publish failure or an
  unconfirmed re-query (exit 3), and registered in scripts/claims_audit.py's SELFTEST_SCRIPTS.

What's out of scope (tracked, not claimed here)

The full #433 surface also calls for an outbox/reconciler, control-issue aggregate comment,
Project-item state sync, and instrumentation of every #424-#431 lifecycle event — those already
have (or will have) dedicated modules (github_lifecycle.py's outbox/reconcile, loop_progress.py
for aggregate %, the stage-agent contract modules for the actual event stream). This PR ships the
identity/idempotency-key/envelope/publish PRIMITIVE both issues actually asked to be defined and
wired, reusing rather than duplicating the existing create-or-update mechanics.

Test plan

• python3 scripts/stage_report.py selftest — PASS (25/25): identity formatting, idempotency-
  key stability/uniqueness, marker scoping, render/status-tag validation, sanitize/truncate,
  and the publish path wired against both a fake and the real pr_evidence.publish_comment
  primitive (create vs. update, no duplicate).
• python3 -m pytest tests/test_stage_report_unit.py tests/test_stage_report_cli_integration.py -q
  — 30 passed.
• python3 tests/test_stage_report_unit.py / python3 tests/test_stage_report_cli_integration.py
  (bare python3, no pytest) — both PASS.
• gh issue view 433/442 --json state confirmed both still OPEN, gh pr list --search 433/442
  confirmed no duplicate PR, before opening this one.
• Full python3 scripts/check.py (2120 collected tests across the repo) was kicked off
  locally; it is a long-running repo-wide e2e/system suite and was still in progress at
  submission time. The one pre-existing claims_audit failure it surfaces
  (scripts/review_panel.py, scripts/stage_coordinator.py missing from
  SELFTEST_SCRIPTS/SELFTEST_EXEMPT) reproduces identically on main before this branch's
  changes and is unrelated to this PR.

Built by Claude Sonnet 5 (Claude Code) via simplicio-loop.