Relink milestones whose GitHub sync never landed (GET)

Sweeps milestones left in github_sync_state pending or failed past their next-attempt time and completes their GitHub link. Safe to run repeatedly: an existing milestone with the same title is linked rather than duplicated. Every run also re-runs the milestone auto-finish rule (a milestone whose last open ticket closed while a GitHub send was in flight finishes here) and closes on GitHub the milestones the database finished on its own (HO-15440). Each GitHub call acts as the row's persisted principal (the close falls back to the project owner); no environment user is read. Protected by CRON_SECRET via the x-cron-secret header.