Fix divergent linked-issue-required check in buildPublicCommentSignalBundle

[JSONbored]

Context

Part of the review-stack architecture audit (parent epic — config-sprawl dimension).
src/signals/engine.ts computes "is a linked issue effectively required" independently at two call
sites that its own doc comment says should be identical:

• publicSafePreflightFindings (src/signals/engine.ts:4239-4242, doc comment at 4234: "so the legacy
  panel and the converged comment filter identically (single source)"): filters out
  missing_linked_issue unless settings.requireLinkedIssue || settings.linkedIssueGateMode !== "off".
• buildPublicCommentSignalBundle (src/signals/engine.ts:5126-5148): filters the same finding but
  checks only args.settings.requireLinkedIssue — omitting the linkedIssueGateMode !== "off" half.

Impact

A repo that opts into gate.linkedIssue: block purely via .gittensory.yml (the modern,
config-as-code way — never touching the legacy DB-backed requireLinkedIssue boolean) gets correct
behavior in the main preflight/comment surface, but the AI-rewrite signal bundle at engine.ts:5148
silently drops the missing-linked-issue signal from the context handed to the optional AI-rewrite layer.
A config field that looks like it goes through the standard override chain but has a special-cased,
incomplete read path at one call site — the exact class of bug this whole audit was launched to find.

Fix

Have buildPublicCommentSignalBundle call publicSafePreflightFindings (or a shared predicate) instead
of re-deriving the condition.

Acceptance criteria

• buildPublicCommentSignalBundle and publicSafePreflightFindings agree on every repo config
  combination.
• Regression test: repo with linkedIssueGateMode: "block" and requireLinkedIssue unset/false
  still surfaces missing_linked_issue to the AI-rewrite signal bundle.

[linear-code]

JSO-3398