feat: per-PR debt delta + shared GitHub helpers

[moyom96]

Context

The scheduled scan files tracked issues weekly, and --verify-pr checks fixes against already-filed issues. Neither gives fast feedback on debt a PR introduces. This adds a per-PR debt delta so contributors see, on the PR itself, the tech debt landing on the lines they changed, with no LLM cost and no new issues.

What Changed

• --pr-delta NUMBER (TechDebt::Delta::PrDelta): runs the static collectors scoped to the PR's changed Ruby files, keeps only findings whose line range overlaps the lines the PR added, and posts a single summary comment grouped by severity. Static-only (no OpenAI key needed) and creates no issues. Optional gating via pr_delta.fail_on (none / high / any).
• Shared GitHub helpers extracted and reused by issue creation, PR verification, and the delta path:
  • Github::Client (Octokit client + repo + token resolution factory)
  • Github::PullRequest (changed-file index, linked-issue parsing, diff-hunk added-line parsing)
  • Github::CommentUpserter (find-by-hidden-marker, update-or-create)
• Comment upsert: PR comments now update in place via a hidden marker instead of stacking on every push. Applied to PR verification too.
• Octokit auto_paginate enabled in the client factory so comment and changed-file listings are not silently truncated at 30 per page (which would have defeated upsert dedup on busy PRs and dropped files on large PRs).
• Collectors emit line/end_line so findings can be intersected with a PR's added lines (also improves issue precision generally).
• LayerCollector path fix: model_file?/job_file? required a leading slash that relative scan paths never have, so the collector never fired in a standard Rails layout. Now anchored to a path-segment boundary.
• Tests: new specs for PrDelta, Client, CommentUpserter, PullRequest, and the debride/complexity/layer collectors. Suite: 54 examples, 0 failures.
• Install generator ships a wall_e_pr_delta.yml workflow (pull_request, concurrency cancel, GITHUB_TOKEN only) and a pr_delta config block.
• Refreshed a stale Gemfile.lock (the gemspec's flay and dev rspec were missing from it).

How to Test

1. mise exec ruby@3.3.6 -- bundle exec rspec (system Ruby 2.6 is incompatible). Expect 54 examples, 0 failures.
2. Dry-run the delta against a PR locally:
   GITHUB_TOKEN=... mise exec ruby@3.3.6 -- bundle exec wall-e --pr-delta <PR> --dry-run
   It prints the comment it would post and the JSON summary; nothing is written.
3. Edge cases:
   • PR touching no Ruby files: reports zero findings, posts the "no new debt" comment.
   • Run twice on the same PR: the comment updates in place (one comment, not two).
   • Set pr_delta.fail_on: "high" and confirm the command exits non-zero only when a high-severity finding lands on changed lines.

Deployment Tasks

• None required. The new wall_e_pr_delta.yml workflow is added by the install generator for downstream consumers; it needs only the default GITHUB_TOKEN. No migrations, env vars, or backfills.