fix: address review findings from rounds 2834-2838

- Unexport RetryBackoff, add SetRetryBackoff method (#17286)
- Rename http field to httpClient to avoid shadowing (#17289)
- Group const blocks into single declaration (#17291)
- Fix CheckRedirect to compare against previous hop, not first (#17302)
- Strip auth header on protocol downgrade https→http (#17297)
- Add maxPages safeguard to pagination loops (#17299, #17300)
- Document mapCheckRunStatus unused second parameter (#17287, #17303)

github/pr.go

@@ -84,13 +84,16 @@ func (c *Client) GetPullRequestDiff(ctx context.Context, owner, repo string, num
 	return string(body), nil
 }
 
+// maxPages is the upper bound on pagination loops to prevent unbounded iteration
+// in case the server returns a full page indefinitely.
+const maxPages = 100
+
 // GetPullRequestFiles fetches the list of files changed in a PR.
 // Paginates through all pages (100 per page) to collect all files.
 func (c *Client) GetPullRequestFiles(ctx context.Context, owner, repo string, number int) ([]vcs.ChangedFile, error) {
 	var allFiles []vcs.ChangedFile
-	page := 1
 
-	for {
+	for page := 1; page <= maxPages; page++ {
 		reqURL := fmt.Sprintf("%s/repos/%s/%s/pulls/%d/files?per_page=100&page=%d",
 			c.baseURL, url.PathEscape(owner), url.PathEscape(repo), number, page)
 		body, err := c.doGet(ctx, reqURL)
@@ -114,7 +117,6 @@ func (c *Client) GetPullRequestFiles(ctx context.Context, owner, repo string, nu
 		if len(files) < 100 {
 			break
 		}
-		page++
 	}
 
 	return allFiles, nil
@@ -175,8 +177,7 @@ func (c *Client) GetCommitStatuses(ctx context.Context, owner, repo, sha string)
 	}
 
 	// Fetch check runs (paginated)
-	checkPage := 1
-	for {
+	for checkPage := 1; checkPage <= maxPages; checkPage++ {
 		checkURL := fmt.Sprintf("%s/repos/%s/%s/commits/%s/check-runs?per_page=100&page=%d",
 			c.baseURL, url.PathEscape(owner), url.PathEscape(repo), url.PathEscape(sha), checkPage)
 		checkBody, err := c.doGet(ctx, checkURL)
@@ -198,13 +199,15 @@ func (c *Client) GetCommitStatuses(ctx context.Context, owner, repo, sha string)
 		if len(checkResp.CheckRuns) < 100 {
 			break
 		}
-		checkPage++
 	}
 
 	return result, nil
 }
 
-// mapCheckRunStatus maps a check run conclusion+status to a vcs.CommitStatus status string.
+// mapCheckRunStatus maps a check run conclusion to a vcs.CommitStatus status string.
+// The second parameter (check run status field, e.g. "completed", "in_progress") is
+// unused because conclusion alone determines the mapped state: nil conclusion means
+// the run is still in progress (pending), regardless of the status field value.
 func mapCheckRunStatus(conclusion *string, _ string) string {
 	if conclusion == nil {
 		// Still running or queued