fix(review): enforce close autonomy on draft-dodge and reopen-reclose paths

[JSONbored]

What

closeDraftDodgeAttemptIfBlocked and recloseDisallowedReopenIfNeeded are 2 of the 5 deterministic
close-enforcement paths that bypass the unified planAgentMaintenanceActions planner by design. Unlike
their 3 correct siblings (closeReviewEvasionSelfCloseIfActive/DraftConversionIfActive/
RepeatedDraftCyclingIfDetected), neither checked the close-specific autonomy class before closing:

• closeDraftDodgeAttemptIfBlocked called resolveAgentPermissionReadiness(...) without
  actionClass: "close", so it checked the union of any acting autonomy class's write-permission
  grant instead of specifically close's.
• recloseDisallowedReopenIfNeeded gated only on isAgentConfigured(...) (true when any class is
  acting), never on resolveAutonomy(..., "close").

Impact: a repo that enables any other autonomy class (e.g. assign: "auto") but deliberately leaves
close unconfigured (documented deny-by-default) could still have PRs auto-closed via these 2 paths.

Fix

Both now resolve close autonomy directly and deny (with an audit event, matching the 3 correct
siblings' shape) when it is not "auto".

Scope note

This issue's second acceptance criterion (extract a shared enforceDeterministicClose helper across all
5 close paths, ~600-700 line reduction) is deferred to an immediate fast-follow PR — keeping this fix
minimal and independently reviewable given the security-sensitive nature of the change.

Testing

4 new regression tests (draft-dodge × {denied, auto_with_approval}, reopen-reclose × {denied,
auto_with_approval}) asserting no write call and a denied audit outcome when close autonomy isn't
auto. Verified these fail pre-fix and pass post-fix. Typecheck clean; full queue.test.ts suite
(787 tests) passes.

Fixes #4602

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.10%. Comparing base (19e1654) to head (1ab582f).
⚠️ Report is 7 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/queue/processors.ts	83.33%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4637      +/-   ##
==========================================
- Coverage   94.11%   94.10%   -0.01%     
==========================================
  Files         432      432              
  Lines       38371    38382      +11     
  Branches    13989    13994       +5     
==========================================
+ Hits        36111    36120       +9     
  Misses       1602     1602              
- Partials      658      660       +2     

Files with missing lines	Coverage Δ
src/queue/processors.ts	95.25% <83.33%> (-0.05%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.