Clarify required-check probe failures when GitHub branch protection metadata is plan-limited

## Summary

`codex-own-pr-daemon status` currently reports `STATUS INCOMPLETE` for every tracked PR when `gh pr checks --required` returns rc=1 with:

```text
no required checks reported on the '' branch
```

In the QTP daemon incident on 2026-06-11, this message initially looked like another `gh` auth/API outage. After fixing the real local auth issue, the warning persisted because the repo/account cannot expose branch-protection required-check metadata through GitHub's branch protection API.

Direct probe from the same daemon `GH_CONFIG_DIR`:

```bash
GH_CONFIG_DIR=/Users/hadriendemarch/.config/gh-qtp-daemon \
gh api repos/hadrien-de-march/QuantTradingPoule/branches/main/protection/required_status_checks --jq .
```

Observed:

```text
gh: Upgrade to GitHub Pro or make this repository public to enable this feature. (HTTP 403)
{"message":"Upgrade to GitHub Pro or make this repository public to enable this feature.","documentation_url":"https://docs.github.com/rest/branches/branch-protection#get-status-checks-protection","status":"403"}
```

## Why this matters

The daemon is correct to fail closed and avoid inferring an empty required-check set. However, the current operator-facing text says:

```text
Required-check probe degraded ... fix the underlying gh / auth / network issue
```

That diagnosis is misleading for private repos where branch protection metadata is unavailable due account/repo tier. It sends operators toward token/network debugging even after auth is healthy.

## Evidence from QTP

Auth/API fixed and validated:

```bash
GH_CONFIG_DIR=/Users/hadriendemarch/.config/gh-qtp-daemon gh auth status --hostname github.com
GH_CONFIG_DIR=/Users/hadriendemarch/.config/gh-qtp-daemon gh api user --jq .login
GH_CONFIG_DIR=/Users/hadriendemarch/.config/gh-qtp-daemon gh pr list --repo hadrien-de-march/QuantTradingPoule --state open --json number --limit 100
```

Repeated validation succeeded:

```text
user attempt=1 ok login=hadrien-de-march
prlist attempt=1 ok count=11
user attempt=2 ok login=hadrien-de-march
prlist attempt=2 ok count=11
user attempt=3 ok login=hadrien-de-march
prlist attempt=3 ok count=11
```

Daemon enumeration also recovered:

```text
all-open owner-scoped to agent=morpheus: owning 11/11 open PR(s); ignoring 0 foreign-owner PR(s): []. hstack#1051.
```

But status still showed every PR under `STATUS INCOMPLETE` because `gh pr checks --required` returned the `no required checks reported` rc=1 path.

## Requested behavior

Please distinguish this failure class explicitly, for example:

- Detect GitHub's private-repo/plan-limited branch-protection 403 when probing required-check metadata.
- Keep the current fail-closed behavior.
- Change the status footer/remediation text from generic `gh / auth / network issue` to something like: `required-check metadata unavailable from GitHub branch-protection API for this private repo/account tier; daemon cannot verify required checks and will fail closed`.
- Ideally include the exact probe command or endpoint that failed so operators can confirm quickly.

## Non-goal

Do not silently treat this as no required checks. The current fail-closed behavior is the right safety default.