fix(gate): enforce self-authored linked-issue evidence

[JSONbored]

Motivation

• Close a policy-bypass where some advisory rebuild/prediction paths did not supply linked-issue author evidence, allowing a repo-configured selfAuthoredLinkedIssueGateMode: "block" to be falsely reported as passing on authorized retriggers and predictions.

Description

• Resolve and pass linked-issue author logins into buildPullRequestAdvisory for scheduled re-gate sweeps so self-authored findings are evaluated. (src/queue/processors.ts)
• Resolve and pass linked-issue author logins in the authorized PR-action advisory builder used by the PR-panel retrigger and gate-override flows so manual retriggers honor the configured blocker. (src/queue/processors.ts)
• Derive linked-issue author evidence from the cached issues collection for the predicted-gate path so public predictions reflect available issue-author data while preserving fail-open semantics. (src/rules/predicted-gate.ts)
• Add regression unit tests covering the authorized-action advisory path and predicted-gate behavior when issue-author evidence is present or absent. (test/unit/gate-check-policy.test.ts, test/unit/predicted-gate.test.ts)
• Files changed: src/queue/processors.ts, src/rules/predicted-gate.ts, test/unit/gate-check-policy.test.ts, test/unit/predicted-gate.test.ts.

Testing

• Ran npx vitest run test/unit/predicted-gate.test.ts test/unit/gate-check-policy.test.ts; both test files passed (all added regression tests succeeded).
• Ran npm run typecheck; typecheck completed successfully with no errors.
• Attempted npm run test:coverage; tests ran but coverage remapping failed with an environment/tooling error (TypeError: jsTokens is not a function).
• Attempted npm audit --audit-level=moderate; the npm audit endpoint returned 403 Forbidden in this environment.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.79%. Comparing base (ecddb0e) to head (6a2c756).
⚠️ Report is 9 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1222   +/-   ##
=======================================
  Coverage   94.79%   94.79%           
=======================================
  Files         158      158           
  Lines       19126    19132    +6     
  Branches     6927     6928    +1     
=======================================
+ Hits        18130    18136    +6     
  Misses        399      399           
  Partials      597      597           

Files with missing lines	Coverage Δ
src/queue/processors.ts	86.26% <100.00%> (+0.01%)	⬆️
src/rules/predicted-gate.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[JSONbored]

Re-implemented fresh on current main. Your diagnosis was correct — the self-authored-linked-issue finding was only threaded on the main webhook path, leaving the re-gate sweep, the authorized-PR-action path, and the predicted-gate preview without it. The new PR wires all three, adapted to the live-fetch-fallback resolveLinkedIssueAuthorLogins signature (the 5-arg form that landed in #1238 after this PR was branched) and the predicted-gate's snapshot resolution. Thanks for catching the inconsistency.