github-tools: paginate PR diff and review-comment fetches

[TheGreatAxios]

Fixes CL-7140 — https://linear.app/abklabs/issue/CL-7140

Problem

fetchPullRequestDiff (packages/github-tools/src/pull-requests.ts) and
fetchPullRequestReviewComments set per_page=100 and issued a single
request, with no follow of the Link: rel="next" header and no page=
loop. A pull request with more than 100 changed files silently lost
files 101+; more than 100 review comments silently lost the rest, and
packages/code-review's dedupe then re-posted findings it had already
made because it never saw the earlier comments.

Change

• Added fetchAllPages, a paginating GET helper that follows the
  Link: rel="next" header when GitHub sends one, and falls back to
  incrementing page= when it doesn't (some servers/tests omit it).
  Capped at 30 pages; hitting the cap sets truncated: true.
• PullRequestDiff gains a truncated: boolean field.
  fetchPullRequestReviewComments now returns
  { comments, truncated } instead of a bare array.
• Response parsing still goes through the existing arktype schemas
  (PullRequestFilesResponse, ReviewCommentsResponse), now validated
  against the merged page rather than a single page.
• packages/code-review's aggregateReview now posts one plain note
  in the review body ("This review may be incomplete: ...") whenever
  either the diff or the already-posted-comments page was truncated —
  a truncated fetch was previously reviewed silently as if it were
  complete, which risked re-flagging a finding whose earlier post fell
  outside the read page. Threaded through
  CodeReviewGitHub.listPostedComments and runPullRequestReview.
• Renamed MAX_FILES_PER_PAGE to MAX_ITEMS_PER_PAGE (it bounds both
  the files and comments endpoints) and had fetchAllPages reuse
  requestJSON's error formatting via a shared fetchJSON helper
  instead of duplicating it.
• Bumped @corbits/github-tools to 0.0.8 (two src changes) and
  updated the { name, version } pin literals that reference it
  (workflows/code-review, workflows/last-30-days-research, and
  that workflow's test fixture).

Tests

packages/github-tools/src/pull-requests.test.ts: a fake fetch serving
two pages (merged via Link: rel="next" and via a page= fallback), a
single short page (unchanged behavior), and a page-bound case that
reports truncated: true — for both fetchPullRequestDiff's file list
and fetchPullRequestReviewComments.

packages/code-review/src/aggregate.test.ts and review-run.test.ts:
red/green coverage that a truncated diff and a truncated comments page
each surface the incompleteness note (at the aggregation layer and
end-to-end through runPullRequestReview), and that an untruncated
run posts no note.

Local gate note: the machine was under heavy load, so the full
monorepo-wide bun run check could not be run reliably (it was
getting OOM-killed partway through, on packages this change never
touches). Ran targeted gates instead — tsc --noEmit and bun test
for packages/github-tools and packages/code-review,
check:tool-package-pins, check:tool-package-freshness — all green.
CI's bun run check is the authoritative gate for this PR, and it is
green on every job.