fix(ci): include failing CI run link in merge-queue dequeue Slack notification

[AztecBot]

Summary

When a PR is removed from the merge queue, the Slack notification currently shows only View PR. This change adds a View failing CI run link (and includes the URL in the ClaudeBox kickoff prompt) so the on-call engineer can jump straight to the failing workflow.

GitHub's pull_request.dequeued webhook payload does not include the failing workflow run URL, so the notifier now queries GitHub by PR_HEAD_SHA:

1. GET /repos/{owner}/{repo}/commits/{sha}/check-runs — pick the newest check-run whose conclusion is failure, timed_out, action_required, cancelled, or startup_failure. Use details_url (falling back to html_url).
2. If no check-run matches, fall back to GET /repos/{owner}/{repo}/commits/{sha}/status and pick the newest commit-status whose state is failure or error, using target_url.

If neither lookup turns up a URL (e.g. permission issue, no recorded failures yet), the notifier degrades gracefully and posts the existing View PR-only message — there is no hard dependency on the new path.

Changes

• .github/workflows/merge-queue-dequeue-notify.yml — pass GITHUB_REPOSITORY, PR_NUMBER, and PR_HEAD_SHA into the notify-dequeued step. GITHUB_TOKEN was already present.
• ci3/merge_train_failure_slack_notify — add github_api and find_dequeued_failure_url helpers and weave the resolved URL into both the Slack message (| <url|View failing CI run>) and the ClaudeBox kickoff prompt.

Verification

• git apply --check -p1 clean against current next (db4ec5813f).
• bash -n ci3/merge_train_failure_slack_notify — syntax OK.
• git diff --check — no whitespace issues.
• The lookup strategy was pre-validated against a real failed merge-train head SHA (628520896cec2bf75dfb92fbd5c836e1f5f6a527) and returned a concrete Actions URL (actions/runs/25949040437/job/76283124602).

Acceptance

After merge, a real dequeued merge-train Slack notification should contain both View PR and View failing CI run, and the ClaudeBox kickoff prompt should include the raw failing run URL.

---

Created by claudebox · group: slackbot

[AztecBot]

Maintainer review nudge from the claudebox TODO close-out path: this PR is the remaining external blocker for the Auditbox/Slackbot merge-queue notifier TODO. Current status from claudebox: not draft, MERGEABLE, checks green enough for review, blocked on REVIEW_REQUIRED. Acceptance after merge is a real dequeued merge-train Slack notification that contains both View PR and View failing CI run, with the raw failing run/check URL included in the ClaudeBox kickoff prompt.

[AztecBot]

@charlielye quick review nudge for the remaining claudebox TODO blocker. Auto-merge is armed on this PR now, checks are green/expected-skipped, and the only current blocker is required review. After it lands, claudebox will still need to prove a real dequeued merge-train Slack notification includes both View PR and View failing CI run.