fix(gh): bypass the stale run cache with a created filter

GitHub answered the confirming run query with a weeks-old cached result
even with page=1, so alerts for fixed workflows stayed. A created filter
changes the query each day and reads current runs.

internal/gh/fetch.go

@@ -14,14 +14,16 @@ import (
 )
 
 const (
-	maxFailingNames  = 5
-	runsPerWorkflow  = 5
-	maxWorkflows     = 100
-	eventPullRequest = "pull_request"
-	eventPullReqTgt  = "pull_request_target"
-	statusStateFail  = "failure"
-	statusStateError = "error"
-	statusStatePend  = "pending"
+	maxFailingNames = 5
+	runsPerWorkflow = 5
+	// freshRunsWindowDays bounds the created filter of the confirming run query.
+	freshRunsWindowDays = 30
+	maxWorkflows        = 100
+	eventPullRequest    = "pull_request"
+	eventPullReqTgt     = "pull_request_target"
+	statusStateFail     = "failure"
+	statusStateError    = "error"
+	statusStatePend     = "pending"
 )
 
 // backgroundEvents are triggers that run without a person pushing code.
@@ -374,9 +376,11 @@ func (c *Client) workflowRuns(ctx context.Context, full string, id int64, branch
 	path := fmt.Sprintf("/repos/%s/actions/workflows/%d/runs", full, id)
 	get := c.getJSON
 	if fresh {
-		// GitHub can keep answering one exact query from an old cached result, for weeks, whatever
-		// the connection. A different query string skips that entry and reads current runs.
+		// GitHub can keep answering a branch query from an old cached result, for weeks, whatever
+		// the connection, and page=1 alone does not skip it. A created filter changes the query
+		// every day and reads current runs.
 		q.Set("page", "1")
+		q.Set("created", ">="+c.now().UTC().AddDate(0, 0, -freshRunsWindowDays).Format(time.DateOnly))
 		get = c.getJSONFresh
 	}
 	if err := get(ctx, full, path, q, &out); err != nil {