fix(dup-winner): order open-sibling query by number so the cap keeps the winner

[JSONbored]

Summary

Closes audit finding 3.9. listOtherOpenPullRequests applied LIMIT(100) with no ORDER BY. The duplicate-winner adjudication (isDuplicateClusterWinner) elects the minimum open PR number as the cluster winner — but on a repo with >100 open PRs, an unordered LIMIT (rows in unspecified/insertion order) could drop the true lowest-numbered sibling, mis-electing a higher-numbered PR as winner (sparing it and closing the real winner). Now ordered by ascending number so the 100-row window always retains the lowest open siblings.

Finding 3.10 (number-based election with no quality check) is the documented, owner-flag-gated design per the audit — out of scope here.

Scope

• Backend only (src/db/repositories.ts); no schema change; no migration
• Gated behind owner-only GITTENSORY_DUPLICATE_WINNER (default off); a latent-correctness fix regardless

Validation

• npm run test:ci — full gate green
• npm audit --audit-level=moderate — 0 vulnerabilities
• New test: 102 open PRs with feat(docs): add install site and mcp diagnostics #1 inserted last → the ascending-number order retains feat(docs): add install site and mcp diagnostics #1 within the 100-cap (fails without the fix)

Safety

• No secrets / wallets / hotkeys / trust scores / reward values
• No site/ / CNAME / lovable

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.96%. Comparing base (a50678e) to head (a7907ff).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1236   +/-   ##
=======================================
  Coverage   94.96%   94.96%           
=======================================
  Files         177      177           
  Lines       19772    19772           
  Branches     7110     7110           
=======================================
  Hits        18776    18776           
  Misses        397      397           
  Partials      599      599           

Files with missing lines	Coverage Δ
src/db/repositories.ts	96.03% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.