Refuse ci-pr on native repos and share one absence check

ci-pr only applies to GitHub-backed trails, so an Entire-native repo is refused before any request, as update-branch refuses the reverse. The agents fallback uses api.RawJSONAbsent instead of its own copy, the rerun-review help names both --json shapes, and the dashboard's failed agents read and unreadable agents paths are tested.