Tickets keep their repository from the sub-issue graph to the Run #672

This was generated by AI during triage.

Private record: https://github.com/JacobStephens2/thirdshift/security/advisories/GHSA-67gm-q7cv-hrm3

What to change

Each Ticket keeps the full IssueUrl GitHub returns for its sub-issue node, and each blocker keeps its repository too. TicketBoard and start_ticket work with those identities, not bare numbers, and Tickets are no longer rebuilt with IssueUrl::sibling. A sub-issue outside the Spec's repository is never started; it is reported the way an Unready Ticket is. A Security fix applies the same rule when it checks its Spec's Tickets.

Acceptance criteria

• The tickets query reads each sub-issue's and each blocker's URL or repository, and Ticket keeps them.
• start_ticket gives the child Run the Ticket's own IssueUrl, and no Ticket path calls IssueUrl::sibling any more.
• A sub-issue in another repository is never started, and the Tickets checklist names it as not startable.
• A blocker in another repository that has the same number as a Ticket isn't treated as that Ticket.
• A Security fix's check of its Spec's Tickets rejects a sub-issue outside the fix issue's repository.
• In-process tests on the TicketBoard and Outside seams cover each case above.

Out of scope

• Supporting Tickets in other repositories.
• Changing how Pickup runs or the Ready issue search read issues.