fix(gate): apply the self-authored-linked-issue block on every advisory path

[JSONbored]

Summary

The self-authored-linked-issue finding (#audit-3.11) fired only on the main webhook review path. The same advisory is built in three other places that did not thread linkedIssueAuthorLogins — so whether a self-authored PR got blocked depended on which path evaluated it:

Path	Risk
sweepRepoRegate (re-gate maintenance sweep)	Re-evaluates stale open PRs and can drive auto-maintenance → a self-authored PR re-gated here passed.
buildAuthorizedPrActionAdvisory (gate-override / PR-panel retrigger)	An authorized merge/close action skipped the block.
buildPredictedGateVerdict (MCP predicted-gate preview)	Already passed gate.selfAuthoredLinkedIssue to evaluateGateCheck, but never produced the finding for it to act on — so a configured self-authored gate never showed in the preview.

All three now thread the linked-issue authors:

• The two live paths resolve them exactly like the main path — cache-first via resolveLinkedIssueAuthorLogins, with the live-fetch fallback only when the gate can actually block (mode === "block") and an installationId is available (sourced from the repo record).
• The offline predicted-gate resolves them from the issues snapshot it already holds (no live fetch).

This makes the gate's self-authored verdict consistent across every path rather than dependent on the trigger.

Scope

• Backend only (src/queue/processors.ts, src/rules/predicted-gate.ts); no schema change; no migration
• buildAuthorizedPrActionAdvisory is now exported for a direct unit test

Validation

• npm run test:ci — full gate green
• npm audit --audit-level=moderate — 0 vulnerabilities
• New tests: the sweep blocks a self-authored re-gate; an authorized PR action blocks a self-authored linked issue (and does not flag another author's issue, and tolerates a missing repo / non-blocking mode); the predicted-gate surfaces the self-authored blocker (and not for another author / an issue absent from the snapshot)
• Every changed line + branch covered

Safety

• No secrets / wallets / hotkeys / trust scores / reward values; the change only makes a configured gate fire more consistently (it never blocks when the mode is off/advisory)
• No site/ / CNAME / lovable

Credit: the gap was identified by #1222 (built on the pre-#1238 3-arg resolveLinkedIssueAuthorLogins); this re-implements it on current main with the live-fetch-fallback signature and the predicted-gate snapshot path.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.97%. Comparing base (ff0eade) to head (8148f99).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1252   +/-   ##
=======================================
  Coverage   94.97%   94.97%           
=======================================
  Files         177      177           
  Lines       19806    19810    +4     
  Branches     7125     7126    +1     
=======================================
+ Hits        18811    18815    +4     
  Misses        397      397           
  Partials      598      598           

Files with missing lines	Coverage Δ
src/queue/processors.ts	86.74% <100.00%> (+0.02%)	⬆️
src/rules/predicted-gate.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.