fix: hard-fail check-ig-pin on a definitive 404/422 from the compare API (#931)

Same fix as armosec/private-node-agent's port of this script: the GitHub
compare API call ignored the HTTP status code entirely, so a 404 (typo'd
commit hash, a commit never pushed, or any other invalid ref) fell into
the "unexpected/empty response" branch and PASSED as merely inconclusive
-- letting a clearly-bogus pin slip through the one check meant to catch
exactly that. Flagged independently by GitHub Copilot's automated review
on private-node-agent#548.

Captures the HTTP status via curl's -w alongside the response body, and
hard-fails specifically on 404/422 (a definitive "this commit doesn't
exist" answer) while still treating other non-200 codes (403 rate
limits, 5xx, timeouts) as inconclusive WARN+PASS, same as before.

Verified: real go.mod (pin at a real merged commit) still passes; a
synthetic pin at a nonexistent commit now correctly fails via the new
404 path (previously would have passed silently).


Claude-Session: https://claude.ai/code/session_01RkqzGWrCDfXSaCYHuZpuQa

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>