GCSS-1167: handle import errors

[dev-milos]

Handle import errors better (repo not found)

Fixes G-Research/gr-oss#1167

Problem

When the importer was asked to import a repository that doesn't exist (or that the GitHub App can't see), it produced a noisy, confusing failure:

• The error was doubled — ImportRepo wrapped it (failed to fetch repo: ...) and the command wrapped it again (failed to import repo: ...).
• Cobra then dumped the full command usage/help text on top of the real message, burying it.
• The raw 404 carried no actionable hint about why it failed.
• In GitHub Actions the failure was just a buried log line with no annotation in the run summary.

There was also a latent nil-pointer panic: several API error paths dereferenced the HTTP response (r.Status / r.StatusCode) without a nil check, so a transport-level error would crash with a stack trace instead of a message.

Changes

pkg/github/github.go

• Added an ErrRepoNotFound sentinel error.
• ImportRepo now detects HTTP 404 (r != nil && r.StatusCode == http.StatusNotFound) and returns a single, clear message with guidance: "repository not found: "owner/repo" — check the spelling and that the GitHub App is installed and has access to it".
• Added the missing r != nil guard on the rulesets 403 path (latent nil-deref) and switched its error to %w for consistent wrapping.

cmd/import.go

• Dropped the redundant failed to import repo: %w wrap so the underlying message surfaces once.

cmd/root.go

• Set SilenceUsage + SilenceErrors on the root command so runtime errors no longer trigger a usage dump; errors are printed once by Execute.
• Under GitHub Actions (GITHUB_ACTIONS=true), emit a ::error:: workflow-command annotation so the message shows up in the run summary, with proper escaping (%, \r, \n) per GitHub's spec.

cmd/root_test.go (new)

• Table test for escapeAnnotation covering each escape, a combined case, and that % is escaped before replacements are re-scanned.

Justfile

• Added set -euo pipefail to the import-repo recipe (a shebang recipe) so a failed import aborts instead of falling through to cp a stale/missing YAML.

Before / After

Before

Error: failed to import repo: failed to fetch repo: GET https://api.github.com/repos/owner/nope: 404 Not Found []  (API Response: 404 Not Found)
Usage:
  importer import [owner/repo] [flags]

Flags:
  -h, --help   help for import
... (full usage dump)

After

Error: repository not found: "owner/nope" — check the spelling and that the GitHub App is installed and has access to it

Plus, in GitHub Actions, a ::error:: annotation on the run summary.

[pavlovic-ivan]

LGTM 🚀