fix(github): add GraphQL fallback for every endpoint with a 1:1 counterpart

GitHub Elasticsearch incidents (https://www.githubstatus.com) cause REST GETs to return HTTP 200 OK with a zero-byte body across the entire API surface — not just the releases listing. There's no error code, no Retry-After, no rate-limit signal; pRetry can't tell this apart from a healthy "no result" response and JSON.parse('') throws an unrelated SyntaxError that hides the upstream cause.

Audit every github.ts and releases/github.ts call site, mapping each REST endpoint we use to its 1:1 GraphQL equivalent. Add fallbacks only where GraphQL exposes the same data the REST caller actually consumes (no scope creep):

* fetchGitHub now throws a typed GitHubEmptyBodyError on 200 + 0-byte bodies so callers can switch on instanceof rather than parsing chaos.
* fetchRefSha (tag/branch/commit cascade) -> repository.ref(qualifiedName) + repository.object(oid) in one query; resolves all three forms with one round trip during incidents.
* fetchGhsaDetails -> securityAdvisory(ghsaId), normalizing two field-name diffs: severity case (GraphQL uppercases) and identifiers -> aliases (filter out the GHSA self-reference to match REST's exclusion).
* getReleaseAssetUrl -> repository.release(tagName).releaseAssets, normalizing GraphQL's downloadUrl field back to REST's browser_download_url so the asset matcher works unchanged.

Skipped fetchGitHub itself (caller-provided URL has no single GraphQL counterpart — caller's responsibility) and getReleaseAssetUrl's per-tag REST hit on a healthy backend (the existing path stays primary; GraphQL only fires after detecting the empty-body shape).

Also pin Error / JSON.parse / JSON.stringify / Array.isArray as local primordial aliases in both files (matches src/packages/provenance.ts convention).

164/164 tests pass — 87 in github.test.mts (5 new fallback tests for empty-body detection, GraphQL tag/branch/annotated-tag resolution, GraphQL GHSA normalization), 44 in releases-github.test.mts (1 new test for getReleaseAssetUrl GraphQL fallback), 33 unchanged in releases-socket-btm.test.mts.

Author: jdalton