fix(agent-actions): apply account-age throttle on issue contributor-cap path

[RealDiligent]

Summary

Completes the issue-path half of the account-age throttle (#2561): repos that configure accountAgeThresholdDays now get the same anti-ban-evasion friction on issues as they already do on PRs.

Supersedes closed #3179 (codecov patch on first push).

Problem

#2561 shipped account-age throttling on the PR maintenance path (tighter contributorOpenPrCap + newAccountLabel), but RepositorySettings explicitly documented that the issue-path enforcement did not read accountAgeThresholdDays. A contributor with a fresh account could bypass the tightened cap by opening issues instead of PRs.

Root cause

maybeCloseIssueOverContributorCap used the raw contributorOpenIssueCap without the half-cap adjustment applied on the PR path, and newly opened issues never received the newAccountLabel.

Implementation

• maybeCloseIssueOverContributorCap: resolve account age via getGithubUserCreatedAt; tighten per-repo issue cap to max(1, ceil(cap/2)) for below-threshold authors (fail-open when lookup fails).
• Issue opened webhook: apply newAccountLabel when review_state_label autonomy is auto, mirroring PR-path exemptions.
• types.ts: update doc comment — setting now applies to both PR and issue cap paths.

Testing performed

• npm run typecheck
• New account: tighter cap + label
• Established account: full cap, no label
• Threshold off: no user lookup
• review_state_label not auto: no label, cap still enforced
• User lookup failure: fail-open to full cap

Compatibility

• Default unchanged (accountAgeThresholdDays: null).

Why this approach

Mirrors the existing, tested PR-path contract. Closes a documented enforcement gap with minimal diff and low regression risk.

Candidate comparison

Also evaluated: secret-scan gate/enrichment parity (active competing PRs #3172, #3041); cross-line secrets (#2454 branch exists); transient locks (merged #3050/#3164). Selected for unique scope and documented intent.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - fixes required

_{Review updated: 2026-07-05 05:13:38 UTC}

3 files · 1 AI reviewer · no blockers · readiness 80/100 · CI failing · blocked

🛑 Suggested Action - Fix Blockers

Review summary
The change correctly extends the account-age throttle to the issue contributor-cap path and covers the important reachable cases: below-threshold tightening, threshold disabled, established account, label autonomy disabled, and lookup fail-open. I do not see a correctness blocker in the visible diff, but the implementation now duplicates account-age lookup work on opened issues and leaves one adjacent doc comment stale.

Nits — 5 non-blocking

• src/queue/processors.ts:4706 does the account-age user lookup before confirming `contributorOpenIssueCap` is configured and before checking `autoCloseExemptLogins`, so repos with only the threshold configured pay an unnecessary `/users/{login}` request on every opened issue.
• src/queue/processors.ts:5509 and src/queue/processors.ts:4707 can call `getGithubUserCreatedAt` twice for the same opened issue when both labeling and cap enforcement run, which is avoidable rate-limit pressure on a hot webhook path.
• src/types.ts:853 still documents `newAccountLabel` as applying to a below-threshold-age account's PR, but this PR intentionally makes the label apply to issues too.
• Move the `contributorOpenIssueCap` and `autoCloseExemptLogins` guards ahead of the account-age fetch in `maybeCloseIssueOverContributorCap`, then compute `effectiveIssueCap` only after the function knows the cap path is active.
• Extract the account-age calculation into a small helper or pass the already resolved created-at/new-account result from the issue `opened` path into `maybeCloseIssueOverContributorCap` so one webhook does not fetch the same GitHub user twice.

CI checks failing

• validate
• validate-code

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#3179
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 129 registered-repo PR(s), 17 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	RealDiligent; Gittensor profile; 129 PR(s), 0 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: RealDiligent
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: Ruby, Svelte, TypeScript, Cuda, JavaScript, Markdown
• Official Gittensor activity: 129 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Await review-lane availability.
• Refresh registry data or choose a registered active repo.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory is closing this pull request on the maintainer's behalf (CI is failing (validate, validate-code)). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.