fix(review): elect duplicate-cluster winner by true PR creation time

[JSONbored]

Summary

• isDuplicateClusterWinnerByClaim elected a duplicate-cluster's surviving PR by linkedIssueClaimedAt — gittensory's own sync-observation time, not GitHub's real pull_request.created_at. When processing falls out of creation order (a stalled sweep catching up on a backlog, backfill reordering, delayed webhook delivery), the election could crown whichever PR gittensory happened to observe first instead of whoever actually opened their PR first, silently mis-crediting a later contributor over an earlier one.
• Threads GitHub's true creation time (already persisted in payloadJson, already surfaced by toPullRequestRecordFromRow, just never wired into the election) into the winner comparison, preferring it whenever both sides of a comparison have a valid one and falling back to the legacy claim-time comparison unchanged otherwise — so sparse/legacy rows keep their existing fail-closed behavior exactly.
• Also fixes toPullRequestRecord (the raw-webhook-payload constructor) to populate createdAt on the immediate upsert return, matching what toPullRequestRecordFromRow already did on a later DB read.
• Names the actual winning PR number in a loser's close comment (duplicate of open PR #N) instead of the generic "duplicate of another open PR" wording, when the election is confident enough to name one — so a closed contributor can verify their work wasn't silently discarded.
• No migration needed: created_at was already being persisted; this only wires already-stored data into the election logic that never looked at it.

Closes #3816, closes #3817.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/session/CORS surface touched.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — no API/OpenAPI/MCP surface changed; verified via ui:openapi:check.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — backend-only change, no UI touched.)
• Visible UI changes include a UI Evidence section below. (N/A — no visible UI change.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• No DB migration required — created_at was already persisted into payloadJson for every PR row and already surfaced by toPullRequestRecordFromRow; this PR only threads that existing field into the duplicate-winner election and one previously-missing constructor.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.39%. Comparing base (ee686e0) to head (9d01186).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3819   +/-   ##
=======================================
  Coverage   93.38%   93.39%           
=======================================
  Files         323      323           
  Lines       32727    32746   +19     
  Branches    11982    11990    +8     
=======================================
+ Hits        30563    30582   +19     
  Misses       1530     1530           
  Partials      634      634           

Files with missing lines	Coverage Δ
src/db/repositories.ts	96.54% <ø> (ø)
src/queue/processors.ts	94.44% <100.00%> (+<0.01%)	⬆️
src/settings/agent-actions.ts	97.60% <100.00%> (+0.02%)	⬆️
src/signals/duplicate-winner.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.