fix(pm): give check-half-states' transport probe a repo-scoped second stage (#9963)

The probe reported "prerequisite met" in a container where every repo-scoped
endpoint 403s, then the sweep it green-lit failed on its first listing page —
the #4690 inversion inside the mechanism built to prevent it.

Measured 2026-08-19: the obvious hypothesis (the proxy fabricates a
/rate_limit quota) is wrong. /rate_limit there carries server: github.com, a
real x-github-request-id and a real 15000-limit quota, and GET /user returns
the real login — the proxy substitutes a working credential. What it
intercepts is the repo-scoped reads. So the account-scoped observation is
genuinely healthy and identical to the Routine runner's, and only a
repo-scoped read separates them.

Stage 2 is GET /repos/{owner}/{repo}, fired only when stage 1 already said
reachable — so the three failing container classes cost exactly what they did
before, and only the previously-green path spends one core request more. The
match is a structural contradiction (the quota endpoint reports thousands of
core requests left, and a core request was just refused), carrying no vendor
string and no token-shape test — both directions were considered and refused
on the card.

Self-test 273 -> 292 cases; no existing case rewritten. Report-only contract,
exit codes and printed verdict lines all unchanged.

Fixes #9946


Claude-Session: https://claude.ai/code/session_01AeA3nU1B5Q2pgxqxgUrexd

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: os-warren