feat: gate pull-request merges on quiz completion

## Goal

Make quiz completion enforceable through a required GitHub check after the local skill MVP is proven.

## Scope

- Associate each quiz with a repository, pull request, exact head SHA, form ID, and eligible responder.
- Observe Google Forms responses and verify identity and passing score.
- Create or update a GitHub Check Run for the exact head SHA.
- Invalidate previous completion whenever the pull request head changes.
- Document the GitHub App, persistence, webhook, and deployment security model before implementation.

## Acceptance Criteria

- A passing response marks the matching head SHA successful.
- Missing, failing, stale, or differently identified responses cannot satisfy the check.
- Pushing another commit returns the check to pending and requires a new quiz.
- Branch protection can require the Diffler check.
- Secrets, answer keys, and source diffs are not exposed in check output.

## Dependencies

- Depends on the `MVP: Working Skill` milestone.

## Non-Goal

- This is not required for the first working local skill.