Improve tests for "check GitHub actions-SHAs"

[snazy]

1. Use mocks for all tests that rely on remote repo state
2. Introduce GH API helper tests
3. Improve overall test coverage

[snazy]

Follow-up for #356

[potiuk]

@snazy When you pick this back up, could you rebase onto latest main? Keeping the open PRs current with main. Thanks!

[potiuk]

Great follow-up. Addresses 4 of the 5 nits from #356 — json.loads for API bodies, exact-tag matching that drops prefix-matched siblings, the wildcard + untagged-SHA ordering fix, and the typo — each with a regression test (test_matching_tag_prefix_results_do_not_satisfy_shorter_tag, test_wildcard_after_untagged_sha_records_mixed_ref_warning). Live API calls are now mocked, with the real ones gated behind GH_TOKEN. 36 tests, all green. LGTM — thanks!