fix(orb): authorizeFeedbackActor evaluates every command's feedback vote against the default preflight policy, never the actual command's

[JSONbored]

⚠️ Definition of Done: this issue must be completed in full, in a single PR. Do not split this
work across multiple PRs, and do not defer any Deliverable below to a follow-up issue. A PR that
satisfies only some of the Deliverables, stubs a required test, or leaves a checkbox
partially-done does NOT resolve this issue and will be closed.

Context

src/queue/processors.ts:14636-14673's authorizeFeedbackActor calls isAuthorizedCommandActor
without passing commandName, commandAuthorizationPolicy, commandRateLimitPolicy, or
pullRequestOpenAndNotDraft. isAuthorizedCommandActor defaults commandName to "preflight"
(src/github/commands.ts:394), whose default allowed roles are ["maintainer", "collaborator", "confirmed_miner"] (packages/loopover-engine/src/settings/command-authorization.ts:24) — a
materially different policy from chat's (["maintainer", "collaborator", "pr_author"], gated by
commandRateLimitPolicy === "hold", same file lines 144-150).

Consequence: a PR author who was legitimately authorized to receive a chat answer (via the
pr_author + commandRateLimitPolicy: "hold" path, which never requires confirmed-miner status)
gets their own feedback vote (+1/-1 reaction) on that same answer wrongly denied with
pr_author_not_confirmed_miner, unless they also happen to be a confirmed miner. This also silently
ignores any repo's custom commandAuthorization override entirely for feedback voting, since the
policy objects are never threaded through.

Requirements

• authorizeFeedbackActor must pass the real command context (commandName: "chat" or whichever
  command the feedback target belongs to, plus commandAuthorizationPolicy,
  commandRateLimitPolicy, and pullRequestOpenAndNotDraft) to isAuthorizedCommandActor, matching
  how every other command-authorization call site in this file threads that context through.
• Do not change isAuthorizedCommandActor's own logic — only the caller's missing arguments.

Deliverables

• authorizeFeedbackActor passes the correct command context to isAuthorizedCommandActor
  instead of relying on the "preflight" default.
• A new test: a non-maintainer, non-confirmed-miner PR author reacts to their own chat answer
  in a repo with commandRateLimitPolicy: "hold"; assert the vote is now recorded
  (authorized: true) — currently denied.
• A regression test confirms a repo's custom commandAuthorization override for the relevant
  command is now honored for feedback voting (previously silently ignored).

All three Deliverables are required in the same PR.

Test Coverage Requirements

src/** is measured by codecov/patch (99%+ target, branch-counted). Both new tests must exercise
the previously-broken authorization path directly.

Expected Outcome

Feedback voting on a command's answer is authorized against that command's own real policy, not the
unrelated "preflight" default, and respects per-repo commandAuthorization overrides.

Links & Resources

• src/queue/processors.ts:14636-14673 (authorizeFeedbackActor)
• src/github/commands.ts:394 (isAuthorizedCommandActor's "preflight" default)
• packages/loopover-engine/src/settings/command-authorization.ts:24,144-150 (the differing
  policies for preflight vs chat)

[linear-code]

JSO-6027