fix(gate): live-fetch the linked-issue author when the cache misses

[JSONbored]

Summary

Closes audit finding 3.11. resolveLinkedIssueAuthorLogins read the linked issue's author from the local DB only, so a cache miss (issue not yet synced) silently voided the self_authored_linked_issue anti-farming detection (self-filed → self-solved) — fail-open. On a cache miss it now falls back to a live GitHub fetch (fetchLinkedIssueFacts now also returns the author). The fallback is:

• gated on block mode — only fires when selfAuthoredLinkedIssueGateMode === "block", so quiet/advisory paths add zero API calls;
• lazy — the installation token is minted once, only if at least one issue misses the cache;
• fail-safe — a per-issue error or missing facts yields null.

On 3.12 (first-time-grace cache freshness)

Left as-is by design, not overlooked: there is no local signal that distinguishes a genuine newcomer from an unsynced cache; the grace yields a neutral (held, not merged) verdict; the feature is off by default; CI / conflict / hard-rule closes fire independently; and coupling grace to confirmedContributor would violate the gate's documented score/merge separation. Documented rather than fixed speculatively.

Scope

• Backend only (src/queue/processors.ts, src/github/backfill.ts); no schema change; no migration

Validation

• npm run test:ci — full gate green
• npm audit --audit-level=moderate — 0 vulnerabilities
• New tests: live-fetch fallback resolves a cache-missed author; mixed cached/uncached list; no-facts fail-safe; token-mint-failure fail-safe; quiet/advisory paths still cache-only
• Every changed line + branch covered (verified against merged full-suite lcov)

Safety

• No secrets / wallets / hotkeys / trust scores / reward values
• No site/ / CNAME / lovable

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.96%. Comparing base (e3edf74) to head (d15e13f).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1238   +/-   ##
=======================================
  Coverage   94.96%   94.96%           
=======================================
  Files         177      177           
  Lines       19779    19786    +7     
  Branches     7115     7117    +2     
=======================================
+ Hits        18783    18790    +7     
  Misses        397      397           
  Partials      599      599           

Files with missing lines	Coverage Δ
src/github/backfill.ts	92.82% <100.00%> (+<0.01%)	⬆️
src/queue/processors.ts	86.53% <100.00%> (+0.07%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.