feat: harden EvalOpsBot requested review control plane

[haasonsaas]

Summary

• add GitHub App token support for the central PR lens review and review-request dispatcher
• publish best-effort Checks alongside existing evalops-pr-lens statuses, plus tighter finding dedupe and workflow summaries
• add lens routing config, real EvalOpsBot review canary, and setup audit for target repo/secret/workflow drift

Live validation

• Org webhook delivery 3820890163140100000 handled pull_request.review_requested with 202 OK.
• Central run 26135712754 completed successfully from the webhook dispatch.
• Canary PR evalops/.github#97 received an EvalOpsBot PR lens comment with two P0 findings and evalops-pr-lens/meta-review failed the canary head as expected. The canary PR was then closed and the branch deleted.

Test Plan

• ruby -Itest test/evalops_pr_lens_review_test.rb
• ruby -Itest test/evalopsbot_webhook_relay_test.rb
• ruby -Itest test/verify_evalopsbot_review_setup_test.rb
• ruby -Itest test/verify_org_control_plane_contract_test.rb
• actionlint .github/workflows/evalops-pr-lens-review.yml .github/workflows/evalopsbot-review-request-dispatch.yml .github/workflows/evalopsbot-review-canary.yml .github/workflows/evalopsbot-review-setup-audit.yml