fix(branch-protection): security check runs are never added to required status checks #1231

Summary

Add the built-in security check runs to GitHub branch protection's required status checks when configured as mandatory.

Problem / Motivation

The security-suspicious-paths and security-committer-identity checks appear on PRs but are not marked Required by GitHub. The server-side merge gate already treats them as mandatory, but get_required_status_checks() does not read security-checks when constructing branch-protection contexts.

Requirements

1. In get_required_status_checks(), read the existing security-checks config and append SECURITY_SUSPICIOUS_PATHS_STR and SECURITY_COMMITTER_IDENTITY_STR when applicable; use the constants, not string literals.
2. Respect mandatory: false, an empty suspicious-paths list, and committer-identity-check: false when deciding which checks to require.
3. Ensure exclude-runs can remove the security checks.
4. Decide and document whether mandatory security checks are included when a branch has explicit include-runs.
5. Add tests covering mandatory true/false, each individual check being disabled, and exclude-runs removal.
6. Run uv run ruff check --no-fix, uv run ruff format --check, uv run mypy webhook_server/, and uv run --group tests pytest -n auto.

Deliverables

• Code changes
• Tests
• Document explicit include-runs behavior

Notes

Private repositories skip the set_repository branch-protection path and are outside this change. No config schema change is expected.

Assisted-by: PI (stealth/space-bunny-alpha)