GitHub connector: missing Checks / Commit statuses / Code scanning read permissions — CI state is unreadable, forcing a browser fallback

### Problem Statement

The Claude GitHub MCP Connector app requests **read**: actions, metadata; **read+write**: code, discussions, issues, pull requests, repository projects. It does **not** request **Checks**, **Commit statuses**, or **Code scanning alerts** (read).

Consequently these fail for every installation:

```
GET /repos/{owner}/{repo}/commits/{sha}/check-runs -> 403 Resource not accessible by integration
GET /repos/{owner}/{repo}/commits/{sha}/status -> 403 Resource not accessible by integration
```

**This is not org-grantable.** The organisation configure page offers only repository access and suspend/uninstall; permissions are fixed by the app manifest. Repo-scoped tools (issues, pull requests, code, commits) all work correctly — the gap is specific and narrow.

**Impact, measured in one working session (2026-08-13).** Every CI verification during a four-PR sprint had to be read through a browser rather than the API. Over that evening the browser path disconnected three times, and each reconnect cost a round trip. The connector could see the pull request, the diff, the reviews and the commits — but not whether the checks had passed, which is the single fact needed before merging.

We also built a workflow whose entire purpose is to publish required-check state into PR comments, because comments are a surface the connector CAN read. That workaround has since developed its own defect: its hardcoded required-context list drifted from the live branch protection, and its divergence guard did not catch it, because the guard reads a different API surface than the one actually holding the rule. The workaround now under-reports the very checks it exists to report.

Note also: this issue could not be filed through the connector — creating it returned the same 403, because the app is installed on our repositories and not on this one.

### Proposed Solution

Add to the Claude GitHub MCP Connector app manifest, all **read-only**:

- **Checks: Read**
- **Commit statuses: Read**
- **Code scanning alerts: Read**

Existing installations would surface GitHub’s standard permission-update request, which owners can review at Organization Settings -> GitHub Apps -> Configure. Read-only and opt-in per organisation; owners who decline simply keep current behaviour.

### Alternatives Considered

**Publishing check state into PR comments** for the connector to read — implemented and working, but it requires a bespoke workflow per repository, is advisory rather than authoritative, and (as described above) is itself capable of drifting out of sync with the rule it mirrors.

**Reading check state via a browser** — works, but is slow, unreliable across long sessions, and unusable for unattended or scheduled runs.

Neither substitutes for the API returning the data.

### Area

MCP Connector (adding/managing servers)

### Priority

Medium - Would be helpful

### Additional Context

This appears to be the third reported instance of the same shape — a tool the connector advertises that no installation can successfully call, because the manifest does not request the permission and no user-side configuration can grant it:

- #403 — Organization -> Members, blocking get_teams / get_team_members
- #655 — Administration, blocking repository creation

Each asks for one additional scope. It may be worth reviewing the manifest as a whole against the tool surface the connector advertises, rather than adding permissions one at a time.

Start by locating the GitHub App manifest and its permission declarations; the report does not identify a file or test path. Confirm that Checks, Commit statuses, and Code scanning alerts are requested read-only, then verify that the corresponding API calls become accessible after an installation permission update.

Scritto dal modello di indicizzazione a partire dal testo della issue.