v1.6.0: make audit comment ingestion payload-aware

[jeffhuber]

Part of #1066.

Problem

Long pull-request comment histories can prevent Code Mower audits from reaching either reviewer because GitHub comment responses are decoded through the much smaller private-context payload limit. Separately, explanatory prose containing the reserved lineage marker name can be misclassified as control data and fail the audit gate.

PR #1097 required a bootstrap owner override after both conditions affected its audit history.

Scope

Create one shared, bounded comment-history ingestion and lineage-marker classification path for local audits, hosted audit labelers, lane status, gate health, and generated gate workflows.

• Decode authenticated GitHub responses with an explicit GitHub payload budget and distinct actionable diagnostics.
• Fetch complete comment history under page, item, and byte budgets, adaptively reducing page size and restarting safely when necessary.
• Detect omissions, duplicates, incomplete terminal-page proof, and history mutation; fail closed.
• Recognize lineage control data only as an actual standalone HTML control comment.
• Ignore the reserved marker name in ordinary prose, inline code, and fenced examples.
• Continue failing closed for malformed or duplicate actual control comments from trusted authorities.
• Keep untrusted-author behavior and lineage semantics unchanged.

Acceptance criteria

• A comment history larger than 256 KiB and at least 64 comments is ingested completely.
• Adaptive retries neither omit nor duplicate comments.
• An oversized individual comment or exhausted total budget returns a specific bounded-history diagnostic.
• Prose, inline code, and fenced examples containing the reserved marker name are ignored.
• Valid, malformed, duplicate, and untrusted-author control records retain the intended fail-closed semantics.
• Local Codex/Claude audit paths and the generated GitHub gate share the same contract.
• A long-history integration fixture completes both independent audit paths without an owner override.
• Generated workflow drift, focused tests, privacy scan, and normal CI/gate pass.

Delivery

This is a v1.6 release prerequisite. Produce one independently reviewable PR with one writer, exact-head Code Mower audits, and all P0/P1/P2 findings resolved before merge.