ci: checkout api sibling so cross-repo wire-value gate runs in CI

[mastermanas805]

Summary

Wave-3 CI coverage audit (2026-05-21) caught that two registry-iterating regression tests in internal/jobs/coverage_registry_test.go silently t.Skip in worker CI because the workflow doesn't check out the api repo as a sibling. The cross-repo wire-value drift gate runs only on developer machines today (via the ~/Documents/InstaNode/api fallback in findApiRepoRoot()).

Tests affected:

• TestWorkerAuditKinds_ValuesMatchApiConstants — asserts every worker auditKind* constant value matches the api's AuditKind* string value (cross-repo wire drift catcher per CLAUDE.md rule 18).
• TestSupportedAuditKinds_CoveredByApiSpecOrDocumentedWorkerOnly — asserts every supportedAuditKinds entry has either an api-side reliability spec entry or a documented worker-only allow-list entry.

Patch

• ci.yml: add 3rd actions/checkout@v4 step for InstaNode-dev/api using REPO_ACCESS_TOKEN (same PAT pattern as common+proto), mv _api_ci ../api, set INSTANT_API_REPO=$GITHUB_WORKSPACE/../api on the test step.
• deploy.yml: same checkout with path: api (alongside the existing path: worker/common/proto), set INSTANT_API_REPO=$GITHUB_WORKSPACE/api on the test step.

Local verification

$ INSTANT_API_REPO=~/Documents/InstaNode/api make gate
ok  instant.dev/worker/internal/jobs   24.074s
gate: green

Both target tests now run (instead of skip):

--- PASS: TestWorkerAuditKinds_ValuesMatchApiConstants (0.00s)
--- PASS: TestSupportedAuditKinds_CoveredByApiSpecOrDocumentedWorkerOnly (0.00s)

Operator-action gate (PAT scope)

This PR assumes secrets.REPO_ACCESS_TOKEN's fine-grained PAT includes read access to InstaNode-dev/api. The existing comments in both workflows say the PAT was minted with read access to InstaNode-dev/{common,proto} only — if api was not added when api auto-deploy shipped (memory ref #66), the new checkout step will 403/404 on CI.

Operator check:

1. GitHub → settings → Developer settings → Personal access tokens → Fine-grained tokens → REPO_ACCESS_TOKEN (or whatever the PAT is named).
2. Under "Repository access", verify InstaNode-dev/api is in the allowlist (alongside common + proto).
3. If not, add it. Permissions needed: Contents: read.
4. After the PAT is extended, re-run this PR's CI.

If CI on this PR shows the api checkout step failing with Error: fatal: could not read Username for 'https://github.com/' or Error: HTTP 404, that's the PAT-scope issue.

Test plan

• CI on this PR passes (verifies PAT scope + workflow shape)
• Worker deploy on master picks up the cross-repo test (verify via gh run view --log | grep TestWorkerAuditKinds showing PASS not SKIP)

🤖 Generated with Claude Code