fix: move PAT GitHub validation off event loop

[bitloi]

Summary

Move validator-side PAT GitHub validation and test-query work off the axon event loop with asyncio.to_thread.

Root cause: handle_pat_broadcast and handle_pat_check are async axon handlers, but they called synchronous GitHub /user validation and GraphQL test-query helpers directly. A slow or timing-out GitHub request could stall unrelated axon coroutines until the blocking requests call and retry sleeps completed.

Changes:

• Run PAT GitHub validation and test-query calls through the standard asyncio.to_thread pattern already used elsewhere in the repo.
• Keep existing PAT validation semantics, rejection messages, response fields, and storage shape unchanged.
• Recheck the GitHub identity pin immediately before saving a broadcast PAT. Moving the GitHub calls behind await points widens the gap between the existing pin check and save_pat, so this preserves the hotkey identity lock under concurrent broadcasts.
• Add regression tests proving unrelated coroutines are not delayed by slow PAT GitHub work.
• Add a concurrency regression test for the pre-save identity-pin recheck.

Related Issues

Fixes #1386

Type of Change

• Bug fix
• New feature
• Refactor
• Documentation
• Other (describe below)

Testing

• Tests added/updated
• Manually tested

Commands run on the latest revision:

uv run pytest tests/validator/test_pat_handler.py -q
uv run ruff check
uv run ruff format --check
uv run pyright
git diff --check

Results:

25 passed
ruff clean
format check clean
pyright clean
git diff --check clean

Earlier full-branch validation before the final asyncio.to_thread cleanup:

uv run pytest tests/ -x -q  # 880 passed
uv run vulture              # clean

Checklist

• Code follows project style guidelines
• Self-review completed
• Changes are documented (if applicable)