[Repo Assist] refactor(middleware): extract runJqCode helper to eliminate duplicate jq execution logic (#5423)

🤖 *This PR was created by Repo Assist, an automated AI assistant.*

Closes #5409

## Root Cause

`applyJqSchema` and `applyToolResponseFilter` in
`internal/middleware/jqschema.go` contained ~25 lines of nearly
identical gojq execution and error-handling code — identified in the
automated duplicate code analysis #5408.

## Fix

Extracted a private `runJqCode` helper that:
- Wraps `ctx` with `DefaultJqTimeout` when no deadline exists, returning
a `CancelFunc` for the caller to manage
- Runs the pre-compiled `*gojq.Code` against `jsonData`
- Returns the first result with fully typed error handling (`HaltError`,
context errors, generic errors)
- Returns the raw `gojq.Iter` so callers that need to check for multiple
results (like `applyToolResponseFilter`) can do so

Both `applyJqSchema` and `applyToolResponseFilter` now delegate to
`runJqCode`, eliminating the duplication while preserving all existing
behaviour.

## Trade-offs

- `runJqCode` returns a `CancelFunc` rather than using `defer cancel()`
internally — this is necessary because `applyToolResponseFilter` needs
to call `iter.Next()` again after `runJqCode` returns (to check for
multiple results). Using `defer` inside the helper would cancel the
context before that second call.
- Error paths inside `runJqCode` eagerly call `cancel()` and return a
no-op func to avoid leaks.

## Test Status

The Go 1.25.0 toolchain required by `go.mod` cannot be downloaded in
this sandboxed environment (`proxy.golang.org` is blocked). The change
is a straightforward mechanical extraction — no logic changes — and all
error paths are preserved verbatim. CI will run the full test suite on
push.




> [!WARNING]
> <details>
> <summary>Firewall blocked 1 domain</summary>
>
> The following domain was blocked by the firewall during workflow
execution:
>
> - `proxy.golang.org`
>> To allow these domains, add them to the `network.allowed` list in
your workflow frontmatter:
>
> ```yaml
> network:
>   allowed:
>     - defaults
>     - "proxy.golang.org"
> ```
>
> See [Network
Configuration](https://github.github.com/gh-aw/reference/network/) for
more information.
>
> </details>


> Generated by [Repo
Assist](https://github.com/github/gh-aw-mcpg/actions/runs/25629337591/agentic_workflow)
· ● 2.6M ·
[◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw-mcpg+%22gh-aw-workflow-id%3A+repo-assist%22&type=pullrequests)
>
> To install this [agentic
workflow](https://github.com/githubnext/agentics/blob/851905c06e905bf362a9f6cc54f912e3df747d55/workflows/repo-assist.md),
run
> ```
> gh aw add
githubnext/agentics@851905c
> ```

<!-- gh-aw-agentic-workflow: Repo Assist, engine: copilot, version:
1.0.40, model: claude-sonnet-4.6, id: 25629337591, workflow_id:
repo-assist, run:
https://github.com/github/gh-aw-mcpg/actions/runs/25629337591 -->

<!-- gh-aw-workflow-id: repo-assist -->

Author: lpcox