refactor: replace narrow parameter types with context objects (#519)

* refactor: replace narrow parameter types with context objects across action/

pass broader context objects (ToolContext, PromptContext, PostCleanupContext) to
utility functions instead of cherry-picking fields into single-use interfaces.
deletes 8 narrow types, simplifies call sites, and makes buildCommentFooter
synchronous by reading ctx.runId/ctx.jobId directly instead of re-deriving
from env vars and making an extra API call.

Made-with: Cursor

* fix: replace non-null assertion with local guard in validatePushDestination

addresses review feedback — the function now validates pushUrl itself instead
of relying on the caller's check, eliminating the ! assertion.

Made-with: Cursor

* revert: remove GH_TOKEN injection from restricted shell

the original change exposed the git token in restricted-mode shell so
`gh` CLI would work. this is a security regression for public repos: MCP
tools are deliberately constrained (no merge, no release, no arbitrary
API calls), but `gh api` with the token gives full GitHub API access to
any prompt-injected agent.

Made-with: Cursor

mcp/checkout.ts

@@ -145,22 +145,18 @@ export type CheckoutPrResult = {
   instructions: string;
 };
 
-type FetchPrDiffParams = {
-  octokit: Octokit;
-  owner: string;
-  repo: string;
-  pullNumber: number;
-};
-
 /**
  * fetches PR files from GitHub and formats them with line numbers and TOC.
  * this is the core diff formatting logic, extracted for testability.
  */
-export async function fetchAndFormatPrDiff(params: FetchPrDiffParams): Promise<FormatFilesResult> {
-  const files = await params.octokit.paginate(params.octokit.rest.pulls.listFiles, {
-    owner: params.owner,
-    repo: params.repo,
-    pull_number: params.pullNumber,
+export async function fetchAndFormatPrDiff(
+  ctx: ToolContext,
+  pullNumber: number
+): Promise<FormatFilesResult> {
+  const files = await ctx.octokit.paginate(ctx.octokit.rest.pulls.listFiles, {
+    owner: ctx.repo.owner,
+    repo: ctx.repo.name,
+    pull_number: pullNumber,
     per_page: 100,
   });
   return formatFilesWithLineNumbers(files);
@@ -502,12 +498,7 @@ export function CheckoutPrTool(ctx: ToolContext) {
       }
 
       // fetch PR files and format with line numbers
-      const formatResult = await fetchAndFormatPrDiff({
-        octokit: ctx.octokit,
-        owner: ctx.repo.owner,
-        repo: ctx.repo.name,
-        pullNumber: pull_number,
-      });
+      const formatResult = await fetchAndFormatPrDiff(ctx, pull_number);
       const diffPreview = formatResult.content.split("\n").slice(0, 100).join("\n");
       log.debug(`formatted diff preview (first 100 lines):\n${diffPreview}`);
       const diffPath = join(tempDir, `pr-${pull_number}-${headShort}.diff`);