dev.knotless.check

Kept in the runner's account, keyed `<owner hash>.<repo key>.<ref hash>.<commit>.<workflow>`, where each hash is the first 26 characters of the lowercase unpadded base32 SHA-256 of the owner's DID or the full ref name (for a pull's run, the pull's AT-URI), so each commit keeps its own check of each workflow, replaced only when that commit runs again. A pull's run is keyed `<owner hash>.<repo key>.<pull hash>.<commit>.<baseCommit>.<workflow>`, so a run against a newer base is a check of its own. A merge queue's batch's run is keyed the same way, with the hash of `queue <branch>` (the branch's full ref name) in place of the pull's, its last commit and the branch's tip it was built on. A runner may delete checks of no more use: a batch's, a closed pull's, ones superseded by a newer run of the same workflow, and the default branch's after a while. Readers trust only a runner the repository names.