feat(ci-feedback): report exact job failures before workflow completion

[rldyourmnd]

An early failed job currently waits for its entire workflow to finish before it can reach a repair issue. Add explicit unfinished-attempt observation to the public publisher, composite action and reusable workflow. Completed-only reporting remains the default.

Opted-in reporting requires an explicitly completed failed job on the exact repository/run/attempt. Evidence marks the workflow as unfinished and preserves its null final conclusion. No failed job returns pending, never success. The same durable attempt marker reuses one issue through completion or cancellation; the original dated snapshot and human edits are preserved. Polling callers receive explicit attempt_complete, run_status and run_conclusion fields so early publication cannot become a terminal receipt.

Job pagination now enforces the API page bound and rejects conflicting attempt/source identities when supplied. The reusable workflow pins the reviewed action commit. It checks out no project code and adds no scheduler or agent launcher.

Validation: production publisher tests cover opt-in, incomplete/foreign observations, pending work, one issue across cancellation/completion, bounded pagination and ambiguous POST recovery. Actionlint and make verify passed in the primary clone after merging the current main branch. Private executor adoption and live early-delivery evidence remain separate work.