Observe ephemeral runner completion via GitHub API

[intel352]

Summary

• add sidecar endpoints for allowlisted workflow run and run-job reads
• make github-actions-runner-job poll for the GitHub job assigned to the generated runner name after dispatch
• preserve workflow run/job ids in the provider proof and fail closed on terminal GitHub job failure

STG failure this fixes

• v1.0.20 STG workload controller: GoCodeAlone/workflow-compute run 28449575917
• target workflow succeeded on ephemeral runner wfc-stg-ghp-linux-260629fabb6f-1352329e8d5b: run 28449657934
• independent STG snapshot run 28449885661 showed task github-provider-dogfood-linux-20260630135232 still leased with proofs: []
• root cause: the provider job relied on local runner process/stdout completion instead of canonical GitHub run-job state

Verification

• GOWORK=off go test ./cmd/github-actions-runner-job ./internal -run 'EphemeralRunner|RunnerProvider|T915' -count=1
• GOWORK=off go test -race ./cmd/github-actions-runner-job -count=1
• GOWORK=off go test ./... -count=1
• GOWORK=off go build ./cmd/github-actions-runner-job
• git diff --check

Self-review notes

• Kept GitHub token access inside the provider sidecar; workflow-compute and agent payloads remain provider-agnostic.
• Added a regression test for API-observed completion when runner stdout never emits the prior completion marker.
• Added a regression test so terminal GitHub API failure wins over a clean local runner process exit.

[Copilot]

Pull request overview

This PR improves the ephemeral runner provider’s completion detection by observing canonical GitHub Actions workflow/job state via the GitHub API (through the provider sidecar), rather than relying solely on the local runner process/stdout.

Changes:

• Add provider sidecar endpoints + client methods to list workflow runs and workflow run jobs for allowlisted repositories.
• Update github-actions-runner-job to poll GitHub for the job assigned to the generated runner name after dispatch, persisting workflow run/job IDs and failing closed on terminal GitHub job failures.
• Add/adjust regression tests to cover API-observed completion and terminal failure precedence.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
internal/runner_provider_test.go	Adds coverage for listing workflow runs/jobs and extends the fake runner client for the new API surface.
internal/module_runner_provider.go	Extends GitHubRunnerClient, adds run/job types, implements GitHub list calls, and exposes new sidecar HTTP endpoints.
cmd/github-actions-runner-job/main.go	Introduces GitHub job polling logic and sidecar calls to observe workflow/job completion by runner name.
cmd/github-actions-runner-job/main_test.go	Adds regression tests for API-based completion and failure handling; updates existing tests to satisfy new polling behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.