Add retry-on-401 for GitHub API calls

[zyla]

Summary

CI runs are getting long enough that GitHub App installation tokens (1-hour lifetime) expire mid-build. The existing proactive refresh mechanism checks expiresAt before each API call, but doesn't handle cases where GitHub rejects a token the client still considers valid (clock skew, early revocation, network delays).

This PR adds reactive token refresh: when any GitHub API call returns 401, force-refresh the token and retry once.

Changes

src/CommitStatus.hs

• forceRefreshClient — acquires the file lock and always refreshes the token, bypassing both in-memory and file caches
• withFreshClient — calls getClient, executes the request; if response is 401, logs a warning, calls forceRefreshClient, and retries once
• Refactored updateCommitStatus and checkExistingStatus to use withFreshClient

test/FakeGithubApi.hs

• Mock server now issues unique tokens, tracks their actual expiry, and validates them on API calls
• Added tokenExpirationOffset to simulate clock skew (server reports a longer-than-actual token lifetime)

test/Spec.hs

• Added # github token expiration offset N test directive

New test: test/t/slow/github-token-retry-on-401

• Token lifetime=2s, expiration offset=5s, threshold=0
• Server issues token valid for 2s but reports 7s to client
• After 3s sleep, client's token is expired server-side but client thinks it's valid
• withFreshClient catches the 401, force-refreshes, and retries successfully

Testing

All existing GitHub tests continue to pass. New test verified:

stack test --test-arguments "--pattern github"
# All 8 tests passed