Implement PRReader conformance on the GitHub client: GetPullRequest,
GetPullRequestDiff, GetPullRequestFiles (paginated, populates Patch),
GetCommitStatuses (merges commit statuses + check runs).
Adds compile-time PRReader conformance check.

Requires PR A. Part 2 of 3 for #80.

@@ -0,0 +166,4 @@
+// Callers providing a non-nil client are responsible for configuring a safe
+// CheckRedirect policy. Without one, the default net/http behavior will follow
+// redirects and may forward the Authorization header to untrusted hosts.
+func (c *Client) SetHTTPClient(hc *http.Client) {

@@ -0,0 +51,4 @@
+	} `json:"check_runs"`
+}
+
+// GetPullRequest fetches PR metadata.

@@ -0,0 +137,4 @@
+	statusURL := fmt.Sprintf("%s/repos/%s/%s/commits/%s/status",
+		c.baseURL, url.PathEscape(owner), url.PathEscape(repo), url.PathEscape(sha))
+	statusBody, err := c.doGet(ctx, statusURL)
+	if err != nil {

@@ -0,0 +188,4 @@
+	if conclusion == nil {
+		// Still running or queued
+		return "pending"
+	}

@@ -0,0 +293,4 @@
+	if len(files) != 1 {
+		t.Fatalf("expected 1 file, got %d", len(files))
+	}
+	if files[0].Patch != "" {

@@ -0,0 +626,4 @@
+	c := NewClient("token", srv.URL, AllowInsecureHTTP())
+	c.SetHTTPClient(srv.Client())
+
+	_, err := c.GetCommitStatuses(context.Background(), "owner", "repo", "sha")

@@ -0,0 +93,4 @@
+func (c *Client) GetPullRequestFiles(ctx context.Context, owner, repo string, number int) ([]vcs.ChangedFile, error) {
+	var allFiles []vcs.ChangedFile
+
+	for page := 1; page <= maxPages; page++ {

@@ -0,0 +121,4 @@
+
+	return allFiles, nil
+}
+

@@ -0,0 +144,4 @@
+	if err := json.Unmarshal(statusBody, &statusResp); err != nil {
+		return nil, fmt.Errorf("parse commit statuses JSON: %w", err)
+	}
+	for _, s := range statusResp.Statuses {

@@ -0,0 +280,4 @@
+						delay = 0
+					}
+					if delay > maxRetryAfter {
+						delay = maxRetryAfter

@@ -0,0 +145,4 @@
+	// Fetch commit statuses
+	statusURL := fmt.Sprintf("%s/repos/%s/%s/commits/%s/status",
+		c.baseURL, url.PathEscape(owner), url.PathEscape(repo), url.PathEscape(sha))
+	statusBody, err := c.doGet(ctx, statusURL)

@@ -0,0 +175,4 @@
+			return nil, fmt.Errorf("parse check runs JSON: %w", err)
+		}
+		for _, cr := range checkResp.CheckRuns {
+			result = append(result, vcs.CommitStatus{

@@ -0,0 +287,4 @@
+	c.SetHTTPClient(srv.Client())
+
+	files, err := c.GetPullRequestFiles(context.Background(), "owner", "repo", 1)
+	if err != nil {

@@ -0,0 +104,4 @@
+
+	for page := 1; page <= maxFilesPages; page++ {
+		reqURL := fmt.Sprintf("%s/repos/%s/%s/pulls/%d/files?per_page=100&page=%d",
+			c.baseURL, url.PathEscape(owner), url.PathEscape(repo), number, page)

@@ -0,0 +175,4 @@
+			return nil, fmt.Errorf("parse check runs JSON: %w", err)
+		}
+		for _, cr := range checkResp.CheckRuns {
+			result = append(result, vcs.CommitStatus{

@@ -0,0 +1,676 @@
+package github

@@ -0,0 +457,4 @@
+		t.Errorf("expected 'ok', got %q", content)
+	}
+	if attempts != 2 {
+		t.Errorf("expected 2 attempts, got %d", attempts)

@@ -0,0 +38,4 @@
+	decoded, err := decodeBase64Content(resp.Content)
+	if err != nil {
+		return "", fmt.Errorf("decode base64 content for %s: %w", path, err)
+	}

@@ -0,0 +57,4 @@
+}
+
+// decodeBase64Content decodes base64-encoded content from the GitHub contents API.
+// GitHub returns base64 content with line breaks for formatting; we strip \r and \n before decoding.

@@ -0,0 +23,4 @@
+	}
+	body, err := c.doGet(ctx, reqURL)
+	if err != nil {
+		return "", fmt.Errorf("fetch file %s: %w", path, err)

@@ -0,0 +33,4 @@
+		return "", fmt.Errorf("parse file content JSON: %w", err)
+	}
+	if resp.Encoding != "base64" {
+		return "", fmt.Errorf("unexpected encoding %q for file %s", resp.Encoding, path)

@@ -0,0 +37,4 @@
+	}
+	decoded, err := decodeBase64Content(resp.Content)
+	if err != nil {
+		return "", fmt.Errorf("decode base64 content for %s: %w", path, err)

@@ -0,0 +69,4 @@
+	defer srv.Close()
+
+	c := NewClient(srv.URL, "token")
+	_, err := c.GetFileContentAtRef(context.Background(), "owner", "repo", "foo/../bar.go", "main")

@@ -0,0 +97,4 @@
+
+// GetPullRequestFiles fetches the list of files changed in a PR.
+// Paginates through all pages (100 per page) to collect all files.
+// Returns nil (not an empty slice) when the PR has no changed files.

@@ -0,0 +182,4 @@
+				TargetURL:   cr.HTMLURL,
+			})
+		}
+		if len(checkResp.CheckRuns) < 100 {

@@ -0,0 +389,4 @@
+	defer srv.Close()
+
+	c := NewClient("token", srv.URL, AllowInsecureHTTP())
+	c.SetHTTPClient(srv.Client())

@@ -0,0 +76,4 @@
+}
+
+// decodeBase64Content decodes base64-encoded content from the GitHub contents API.
+// GitHub returns base64 content with line breaks for formatting; we strip \r and \n before decoding.

@@ -0,0 +68,4 @@
+	}))
+	defer srv.Close()
+
+	c := NewClient(srv.URL, "token")

@@ -0,0 +137,4 @@
+// If the commit statuses endpoint fails (e.g. 404 for an unknown SHA), the
+// function returns immediately without attempting the check-runs endpoint.
+// If the check-runs endpoint fails after statuses were fetched successfully,
+// the function returns an error (not a partial result) so callers always get

@@ -0,0 +67,4 @@
+		t.Fatal("server should not have been called")
+	}))
+	defer srv.Close()
+

@@ -0,0 +115,4 @@
+		}
+		if len(files) == 0 {
+			break
+		}

@@ -0,0 +194,4 @@
+// Conclusion alone determines the mapped state: nil conclusion means the run is
+// still in progress (pending), regardless of the status field value.
+//
+// Mapping rules:

@@ -0,0 +9,4 @@
+	"strings"
+	"testing"
+	"time"
+)

@@ -0,0 +434,4 @@
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		attempts++
+		if attempts == 1 {
+			w.WriteHeader(429)

@@ -0,0 +108,4 @@
+		body, err := c.doGet(ctx, reqURL)
+		if err != nil {
+			return nil, fmt.Errorf("fetch PR files page %d: %w", page, err)
+		}

@@ -0,0 +179,4 @@
+				Context:     cr.Name,
+				Status:      mapCheckRunStatus(cr.Conclusion),
+				Description: "", // check runs have no human-readable description; conclusion is captured in Status
+				TargetURL:   cr.HTMLURL,