fix(review): publish the authoritative surface-lane verdict on the gate check-run

[JSONbored]

Summary

The published Gittensory Gate check re-derived its verdict (evaluateGateCheck inside createOrUpdateGateCheckRun, app.ts:165), ignoring the surface/content-lane override already merged into the authoritative gateEvaluation (processors.ts, via evaluateWithSurfaceLane). The surface codes — surface_lane_reject / surface_lane_manual — are unknown to that generic path (isConfiguredGateBlocker), so a content-lane PR that was rejected or routed to manual review published a GREEN required check while the disposition auto-closed / held it. The check disagreed with the action (audit #5).

The fix threads the authoritative gateEvaluation into the check-run via an optional precomputed gate:

• createOrUpdateGateCheckRun now uses options.gate ?? evaluateGateCheck(advisory, policy) — when the caller supplies the merged evaluation, the check-run conclusion and output (formatGateCheckOutput) match the disposition exactly.
• applySurfaceGate already produces a fully-formed GateCheckEvaluation (reject → failure + a surface_lane_reject blocker; manual → action_required + a surface_lane_manual warning), so no new code path is needed in isConfiguredGateBlocker.
• Callers without a surface lane omit gate and re-derive exactly as before — byte-identical when the content lane is off (which is also the default).

No GitHub issue — internal review-subsystem audit finding (#5). Narrow: only the flag-gated, per-repo-allowlisted content lane changes behavior.

Scope

• Backend (src/) only — src/github/app.ts, src/queue/processors.ts
• No API/schema, DB/migration, wrangler.jsonc, or UI change
• Narrow, one coherent change

Validation

• npm run test:ci — green (4465 passed | 4 skipped)
• npm run test:coverage — every changed line and branch covered (verified against coverage/lcov.info)
• npm audit --audit-level=moderate — 0 vulnerabilities; typecheck/ui:typecheck clean; git diff --check clean
• New test: github-app.test.ts — a CLEAN advisory (would re-derive to success) with a precomputed surface-lane failure gate publishes failure + the surface title, proving the override is honored (the omitted-gate re-derivation path stays covered by the existing gate-check tests).

Safety

• No secrets / wallets / hotkeys / coldkeys / trust scores / reward values added
• Backward-compatible (omitted gate ⇒ identical re-derivation); content-lane off ⇒ byte-identical
• No public-surface term leakage (surface summaries already sanitized upstream)

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.36%. Comparing base (3ec6bfc) to head (070e11a).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1410   +/-   ##
=======================================
  Coverage   95.36%   95.36%           
=======================================
  Files         192      192           
  Lines       20777    20777           
  Branches     7511     7512    +1     
=======================================
  Hits        19814    19814           
  Misses        383      383           
  Partials      580      580           

Files with missing lines	Coverage Δ
src/github/app.ts	97.11% <100.00%> (ø)
src/queue/processors.ts	88.17% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.