ci: report failed main builds

[castrojo]

Closes #43

Summary

• add a workflow_run listener for completed Build images runs on main;
• create or reopen one exact-title tracking issue, CI is red on main;
• append the failed run URL, commit, conclusion, and failed job names to the issue;
• serialize notifications to prevent duplicate issues from concurrent completion events;
• document the notification contract in docs/skills/ci-tooling.md.

The notifier uses the workflow-provided github.token with issues: write and does not require a PAT or webhook secret.

Validation

• git diff --check passed.
• Static workflow contract checks passed.
• Python and shell syntax checks available in the environment passed where applicable.
• YAML/actionlint/Just validation could not run locally because the required tools are unavailable; GitHub CI will validate the workflow.