fix: address review findings from rounds 2834-2838

- Unexport RetryBackoff, add SetRetryBackoff method (#17286)
- Rename http field to httpClient to avoid shadowing (#17289)
- Group const blocks into single declaration (#17291)
- Fix CheckRedirect to compare against previous hop, not first (#17302)
- Strip auth header on protocol downgrade https→http (#17297)
- Add maxPages safeguard to pagination loops (#17299, #17300)
- Document mapCheckRunStatus unused second parameter (#17287, #17303)

github/client_test.go

@@ -81,7 +81,7 @@ func TestDoRequest_429Retry(t *testing.T) {
 
 	c := NewClient("token", srv.URL)
 	c.SetHTTPClient(srv.Client())
-	c.RetryBackoff = []time.Duration{10 * time.Millisecond, 10 * time.Millisecond}
+	c.SetRetryBackoff([]time.Duration{10 * time.Millisecond, 10 * time.Millisecond})
 
 	body, err := c.doGet(context.Background(), srv.URL+"/test")
 	if err != nil {
@@ -106,7 +106,7 @@ func TestDoRequest_429ExhaustsRetries(t *testing.T) {
 
 	c := NewClient("token", srv.URL)
 	c.SetHTTPClient(srv.Client())
-	c.RetryBackoff = []time.Duration{1 * time.Millisecond, 1 * time.Millisecond}
+	c.SetRetryBackoff([]time.Duration{1 * time.Millisecond, 1 * time.Millisecond})
 
 	_, err := c.doGet(context.Background(), srv.URL+"/test")
 	if err == nil {
@@ -205,7 +205,7 @@ func TestDoRequest_429RetryAfterHeader(t *testing.T) {
 	c := NewClient("token", srv.URL)
 	c.SetHTTPClient(srv.Client())
 	// Use short backoff; Retry-After should override
-	c.RetryBackoff = []time.Duration{1 * time.Millisecond, 1 * time.Millisecond}
+	c.SetRetryBackoff([]time.Duration{1 * time.Millisecond, 1 * time.Millisecond})
 
 	start := time.Now()
 	body, err := c.doGet(context.Background(), srv.URL+"/test")
@@ -246,19 +246,19 @@ func TestDoRequest_RetryAfterDoesNotMutateBackoff(t *testing.T) {
 
 	c := NewClient("token", srv.URL)
 	c.SetHTTPClient(srv.Client())
-	c.RetryBackoff = []time.Duration{1 * time.Millisecond, 1 * time.Millisecond}
+	c.SetRetryBackoff([]time.Duration{1 * time.Millisecond, 1 * time.Millisecond})
 
 	_, err := c.doGet(context.Background(), srv.URL+"/test")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 
-	// Verify the original RetryBackoff slice was not mutated
-	if c.RetryBackoff[0] != 1*time.Millisecond {
-		t.Errorf("RetryBackoff[0] was mutated: got %v, want 1ms", c.RetryBackoff[0])
+	// Verify the original retryBackoff slice was not mutated
+	if c.retryBackoff[0] != 1*time.Millisecond {
+		t.Errorf("retryBackoff[0] was mutated: got %v, want 1ms", c.retryBackoff[0])
 	}
-	if c.RetryBackoff[1] != 1*time.Millisecond {
-		t.Errorf("RetryBackoff[1] was mutated: got %v, want 1ms", c.RetryBackoff[1])
+	if c.retryBackoff[1] != 1*time.Millisecond {
+		t.Errorf("retryBackoff[1] was mutated: got %v, want 1ms", c.retryBackoff[1])
 	}
 }
 
@@ -310,7 +310,7 @@ func TestDoRequest_SkipsAuthWhenTokenEmpty(t *testing.T) {
 func TestNewClient_CheckRedirectStripsAuthOnCrossHost(t *testing.T) {
 	// Verify the CheckRedirect function is configured
 	c := NewClient("secret-token", "https://api.github.com")
-	if c.http.CheckRedirect == nil {
+	if c.httpClient.CheckRedirect == nil {
 		t.Fatal("expected CheckRedirect to be set")
 	}
 }