fix(settings): require issues:write for detected comment mode independent of sample

[philluiz2323]

Closes #467.

writesPrPublicSurface (which gates whether the install preview requires issues: write) checked label capability maximally with shouldApplyPrLabel(settings, "confirmed"), but checked comment capability with shouldPublishPrComment(settings) — whose miner-status arg defaults to "not_checked". For commentMode: "detected_contributors_only" (the DB/API/schema default) that returns false, so when a maintainer previews a not_found/unavailable sample the function concluded the repo doesn't comment and dropped issues: write from required/missing permissions — even though the repo does comment for confirmed miners.

Required permissions are meant to be sample-independent (that's the purpose of the || shouldPublishPrComment(settings) || shouldApplyPrLabel(settings, "confirmed") clauses); this asymmetry made the comment permission flicker with the sample's miner status while the label permission stayed correct.

Change

• Check comment capability with the maximal "confirmed" status, matching the label path.
• Add a regression test: detected_contributors_only + comment_only, non-confirmed sample → issues: write stays required and a missing issues permission is surfaced.

Verification

• Full unit suite green (1255 passed). The new test fails against the old code (which dropped issues: write).

Distinct from #419/#420/#433/#436 (those were pull_requests: write over-privilege; this is issues: write under-reporting).

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#468 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[JSONbored]

@philluiz2323 this is ready from my side.

A few notes:

• The fix correctly evaluates comment capability with the maximal confirmed status, matching the label path.
• The regression test covers the default detected_contributors_only mode and the non-confirmed sample case that previously hid issues: write.
• No code changes requested.

[JSONbored]

Fix failing CI, please @philluiz2323

[philluiz2323]

Fix failing CI, please @philluiz2323

Fixed.

[JSONbored]

@philluiz2323 this is ready from my side.

A few notes:

• The fix correctly evaluates comment capability with the maximal confirmed status, matching the label path.
• The regression test covers the default detected_contributors_only mode and the non-confirmed sample case that previously hid issues: write.
• The previous validate blocker is cleared on the current head; no code changes requested.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.