Repo-agnostic capability audit — review/signals stack (Wave 5 prerequisite)

[JSONbored]

Problem: Miner Wave 5's own epic body (#4778) states that "the maintainer-agent's review/merge authority model (already works on any installed repo)" is reusable as-is for the hosted Rent-a-Loop product. That assumption has never actually been audited — #4780 did exactly this audit for the miner/discovery package (packages/gittensory-miner) and found real gaps (GitHub-only forge assumptions, a DEFAULT_TYPE_LABELS fallback to gittensor:*), which #4784 then resolved for the miner side. The equivalent audit has not been done for the review/signals/rules stack (src/review/, src/signals/, src/rules/) that Wave 5 explicitly says it will reuse.

Area: AMS / ORB shared foundation

Proposal: Audit src/review/, src/signals/, and src/rules/ the same way #4780 audited the miner package: enumerate every gittensory-specific assumption (label taxonomy defaults like DEFAULT_TYPE_LABELS, hardcoded forge/API assumptions, config keys that assume the gittensory/loopover repo itself) that would need to become per-tenant configuration before the review/merge authority model can be handed to an arbitrary rented repository. Audit-and-document only, following #4780's own format (findings-by-file table + "already parameterized" section + a prioritized checklist for the follow-up implementation issue) — no code changes in this issue.

Deliverables:

• A written audit doc (mirroring packages/gittensory-miner/docs/repo-agnostic-capability-audit.md's shape) covering src/review/, src/signals/, src/rules/.
• A prioritized checklist of concrete per-tenant-configuration follow-ups for a future implementation issue.

Acceptance criteria:

• Every hardcoded gittensory-specific assumption in the audited paths is either confirmed already config-driven (with the config key cited) or listed as a follow-up item.
• The known DEFAULT_TYPE_LABELS (gittensor:bug/gittensor:feature/gittensor:priority) fallback — already flagged as out-of-scope by De-hardcode discovery from gittensory's own conventions #4784's own audit resolution — is covered here since it's squarely a review-path concern.

Resources:

• packages/gittensory-miner/docs/repo-agnostic-capability-audit.md (the Repo-agnostic capability audit #4780 audit this mirrors).
• src/settings/pr-type-label.ts:26-28 (DEFAULT_TYPE_LABELS).

Boundaries:

• Audit and documentation only — no implementation in this issue (mirrors Repo-agnostic capability audit #4780's own scope split from De-hardcode discovery from gittensory's own conventions #4784).

---

Part of #4778.

[linear-code]

JSO-3990