feat(self-heal): scope CI signal to a workflow + warn on missing target

Two hardening fixes from the gap review:
- Optional self_heal_ci_workflow scopes the CI signal to one workflow file
  (the workflow-scoped Actions endpoint). Without it, "latest completed run
  across all workflows" could miss a red CI run masked by a later passing
  workflow, or false-trigger on a non-CI workflow — unreliable on a
  multi-workflow repo.
- The loop logs a warning when self-heal is armed but self_heal_project_slug
  is unset, so a misconfiguration isn't mistaken for "all green".

Tests cover the workflow-scoped endpoint.

roboco/config.py

@@ -379,6 +379,16 @@ class Settings(BaseSettings):
             "even when enabled."
         ),
     )
+    self_heal_ci_workflow: str = Field(
+        default="",
+        description=(
+            "Optional GitHub Actions workflow file name (e.g. 'ci.yml') to scope "
+            "the CI signal to. Empty = use the latest completed run across ALL "
+            "workflows on the default branch, which is imprecise when the repo "
+            "has several workflows; set this to the real CI workflow for a "
+            "reliable signal."
+        ),
+    )
     self_heal_originate_enabled: bool = Field(
         default=False,
         description=(