fix: keep first-pass automation responsive - #88

Summary

• escalate an empty cheap-tier response to the pro tier
• post a deterministic, provider-neutral first-pass fallback if both model calls fail or return no usable text
• suppress duplicate bot first-pass comments on reruns
• verify the shared runner end to end for both Issue and PR events

Why

The first-pass workflow for #87 triggered correctly, but DeepSeek returned no non-empty text. The runner treated that as fatal and never reached the GitHub comment call.

Verification

• npm test: 250 passed, 1 filesystem-dependent skipped, 0 failed
• local end-to-end fake API: both Issue and PR events make two empty model calls and still post exactly one fallback comment
• YAML parse and script syntax checks passed

🤖 Generated with OpenAI Codex