#30762 ci: harden fast-checks admission credentials and deadline

The fast-checks admission picker now keeps routing authority and snapshot authority separate and enforces one 180-second deadline across the complete runner census. Missing ROUTE_TOKEN immediately uses measured Blacksmith overflow; the repository GITHUB_TOKEN is never accepted as routing authority. When a snapshot is requested, its own SNAPSHOT_TOKEN client reads it. Every API and artifact request receives the remaining monotonic deadline, including multi-page census reads and retries.

This is a fix-forward for the three P2 follow-ups in #30648: #30743, #30744 and #30745. The optional GitHub(deadline=...) argument is backward-compatible for existing clients. #30724 also edits pr_runner_pool.py for cmux-tui selector guards; this branch changes only the shared client timeout plumbing and fast-checks caller.

Validation: python3 -m unittest tests.test_ci_fast_checks_runner -q (11 passed), python3 -m py_compile scripts/ci/fast_checks_runner.py scripts/ci/pr_runner_pool.py, and git diff --check passed. The existing full test_ci_pr_runner_pool suite was dispatched but exceeded the lane tool window; no full-suite pass is claimed here.

Review receipt: https://github.com/manaflow-ai/cmux/pull/30648#issuecomment-6556379795

Changelog

none

Agent session: agent session

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Hardens the fast-checks admission picker so routing authority and snapshot authority stay separate, and one 180-second deadline bounds the entire runner census.

GITHUB_TOKEN is no longer accepted for fleet census reads; a missing ROUTE_TOKEN immediately falls back to the measured Blacksmith overflow. Snapshot reads use their own SNAPSHOT_TOKEN client. Every API request, retry wait, and artifact download is capped by the remaining monotonic deadline. The new optional GitHub(deadline=...) argument is backward-compatible for existing callers.