CODER-010: Builds fallback for public repos without the GitHub App (unauthenticated read)

[serge-ivo]

Problem

Builds only appear when the GitHub App is installed for a repo's owner — latestRunFor / /deployments require githubAppConfigured + an installationTokenForOwner. But public repos' GitHub Actions runs are readable unauthenticated (GET /repos/{o}/{r}/actions/runs). Today a user pointing the Coder at a public owner/repo still sees available:false if the App isn't installed — an avoidable dead end (blocks CODER-009 from being the only way to see any builds).

Proposal

When no installation token is available, fall back to an unauthenticated GitHub request for the run list (public repos only). Best-effort, clearly bounded:

• Only attempt for repos with a githubRepo; on 401/403/404 (private or rate-limited) return available:false as today.
• Respect GitHub's unauth limit (60/hr per IP, shared across the Worker) — apply it only on the per-repo /deployments path, not the aggregate /builds fan-out (which could burn the budget fast), and lean on the CODER-002 KV/ETag cache to minimize calls.
• Never send any token on the unauth path.

Acceptance

• A public repo shows its latest run in the Builds panel with no GitHub App installed.
• Private repos / rate-limited responses still degrade to available:false (no error).

Priority

Medium — makes the feature demonstrable without the App (pairs with CODER-009).