Retry transient slash-command provenance checks

[Copilot]

Centralized slash-command workflows treated transient GitHub API failures during PR provenance checks as authorization denials, silently skipping downstream execution and leaving status comments unresolved.

• Retry transient failures
  • Wrap PR provenance lookup with the existing retry utility.
  • Retry 5xx, rate-limit, timeout, and network failures with bounded exponential backoff.
• Preserve security behavior
  • Continue failing closed after retries are exhausted.
  • Do not retry permanent API failures or alter fork-provenance validation.
• Regression coverage
  • Cover recovery from a transient 500 response.
  • Cover fail-closed behavior after retry exhaustion.

• Fixes pre_activation fails closed silently on transient GitHub API error during slash_command permission check — conclusion job never runs, reaction comment stuck forever #59183