fix: project-wide audit — dormant bugs, silent failures, missing safety

[jaylann]

Full-project audit (auth/networking, store/notifications, UI, CI/scripts) for dormant bugs, missing safety, and silent-failure paths. No stubs/TODOs/force-unwraps found; ~20 defects fixed below. All fixes have new or extended unit tests where testable.

Auth / networking

• Device-flow polling no longer aborts sign-in on a transient 5xx/429 mid-authorization; it keeps polling.
• Host-supplied poll interval is clamped before nanosecond conversion (overflow trap on hostile input).
• 403 secondary/abuse rate limits are classified as rate-limited (via X-RateLimit-Reset or body hint) even without X-RateLimit-Remaining: 0 / Retry-After, so the store backs off instead of re-polling into a longer lockout.
• Literal + in saved search queries is percent-encoded (previously reached /search/issues as a space).
• Reviews-pagination truncation at the page cap is now logged instead of silent.
• Specific user-facing copy for merge failures 405 (not mergeable), 409 (head changed), 422 — previously a misleading generic "Try again".

Store / notifications

• addAccount forces a refresh so an in-flight poll built before the account existed can't starve it (previously the new account could stay empty indefinitely with polling off).
• removeAccount cancels the merge-readiness poll, which could linger holding removed-account state.
• Batched GraphQL check hydration publishes per account, so a superseded wave can't fire CI banners / advance baselines without the matching display update.
• When rate-limited, hydration still prunes stale CI dots/gates and unblocks the Actions/Releases skeleton on a first-poll rate limit.
• All-neutral check runs (everything skipped/cancelled) roll up to neutral instead of success — no green dot or spurious "CI passed" banner.
• Persisted accounts decode leniently: one corrupt/incompatible element no longer silently signs out all accounts and orphans Keychain tokens.
• rateLimitedUntil cleared on sign-out; markAllRead surfaces both expired-session and generic failures instead of dropping the latter.

UI / mapping

• GraphQL hydration normalizes MERGED to the REST representation (closed + merged flag); null check-run status maps to completed so conclusions classify correctly. The two hydration paths now produce identical values.
• Notification web URLs rewrite only the resource path segment (a repo/owner literally named pulls no longer corrupts the link).
• Search field focus is deferred until the field is mounted, so opening search actually focuses it.
• Verified (no change needed): the popover .task refresh re-fires per open — NSPopover sends full appearance transitions on each show.

CI / scripts / hooks

• require-milestone re-runs when a milestone is added (previously only demilestoned was a trigger, so a blocked PR could never clear).
• Release cask push no longer swallows real commit failures as "no cask change".
• cut-release validates marketingVersion is 3-part semver before bumping.
• commit-msg hook help text corrected to match the enforced rule (history predates a stricter total-length cap, so the text was fixed rather than the rule tightened).

Audited and deliberately unchanged

Defensive-but-unreachable DeviceFlowError arms, Link-header substring parse, 50-item search window (by design), keychain delete-status ignoring (by design), RelativeAge math, badge-count projections, reorder logic, event-monitor lifecycle — all verified correct.

Verification: just check clean, full just test suite green locally.