S62: REST envelopes round 2 (repos + actions list endpoints)

[espadonne]

Summary

Second wave of GitHub-compat envelope work, paired with S60. The
post-S60 dogfood (A02 audit) found that another half-dozen REST
endpoints had the same structural divergence S60 fixed for issues +
PRs + comments: bare arrays where the CLI expects
`{total_count, : [...]}` envelopes, and flat foreign keys
where the CLI expects nested objects.

Five list endpoints + the repo response are addressed here. Issue +
PR `html_url` (B7) is small enough to ship as a follow-on once
each handler's plumbing is touched; out of scope for this PR.

Findings closed

• B9 `GET /actions/workflows` — now returns
  `{total_count, workflows: [...]}`.
• B10 `GET /actions/runs` — now returns
  `{total_count, workflow_runs: [...]}`. Jobs list also wrapped as
  `{total_count, jobs: [...]}`.
• B12 `GET /actions/secrets` (repo + org + user scopes) — now
  returns `{total_count, secrets: [...]}`.
• B13 `GET /actions/variables` (repo + org scopes) — now
  returns `{total_count, variables: [...]}`.
• B14 repo response — added nested `owner: {id, login, type}`
  envelope (legacy `owner_login` / `owner_type` kept for one
  cycle), plus `html_url`, `is_template`, `topics`,
  `license: {key}`, `language`, `size` (KB), `pushed_at` (=
  updated_at for now — we don't track a separate push column).

`presentRepo` grew two parameters (`topics`, `baseURL`); single-
GET and edit paths populate topics via a new `(*Handlers).topicsFor`
helper, while list endpoints skip it to avoid an N+1 (CLI list views
don't render topics anyway).

`owner_type` is rendered as title-case `"User"` / `"Organization"`
in the new envelope to match GitHub's contract exactly, while the
legacy flat `owner_type` keeps its lowercase form.

Test coverage

• Every existing test that decoded a bare-array list now decodes
  the envelope — touched workflows, runs, jobs, secrets (3 scopes),
  variables.
• New positive assertions in `TestRepos_CreateUserScope` for the
  owner envelope, html_url prefix, and pushed_at population.

Test plan

• `go build ./...`
• `SHITHUB_TEST_DATABASE_URL=... go test ./internal/web/handlers/api/... -count=1` (green)
• Full `./...` sweep — pre-existing flakes
  (`worker.TestPool_HappyPath` race-y, `repo handlers TestPullViewRequiredChecksSafeLinksAndRerunControls` DB seed issue) are also failing on origin/trunk; not introduced here.
• `scripts/lint-unused.sh` + `lint-migration-versions.sh` clean
• gofumpt clean on touched files

Follow-ups

• B7 html_url on issue + PR + comment responses — handler-side
  plumbing change, ~one focused commit per response type.
• B3 POST /issues honoring labels/assignees/milestone — separate
  S63 sprint (CLI currently sends them, server ignores).