feat(review): let repos opt out of the built-in hard-guardrail floor

[JSONbored]

Summary

• hardGuardrailGlobs could previously only ADD to DEFAULT_HARD_GUARDRAIL_GLOBS (fix(review): preserve invariant guardrails #3943), so no repo could narrow guardrail-triggered manual-review holds below the built-in invariant floor even when the resulting daily manual-review volume became a real bottleneck.
• Adds an explicit, opt-in hardGuardrailGlobsOverridesInvariants setting: when true, hardGuardrailGlobs fully REPLACES the built-in floor instead of adding to it (including an explicit [] to disable path guardrails entirely). Default false preserves today's safe-by-default, add-only behavior for every repo/self-hoster that doesn't set it.
• Mirrors the change into the @loopover/engine package twin (packages/gittensory-engine/src/review/guardrail-config.ts) and its type/parsing surfaces so the gittensory_predict_gate MCP tool stays in parity with the live engine.
• Fixes a pre-existing doc/code inconsistency: RepositorySettings.hardGuardrailGlobs's own JSDoc, config/examples/README.md, and config/examples/gittensory.full.yml disagreed with each other and with the actual (add-only) code behavior. Reconciled all three around the restored, documented contract.

Scope

• In wantedPaths (src/, test/, packages/, .github/workflows/)
• No secrets/wallets/hotkeys/trust-scores/reward values
• No site/, CNAME, **/lovable/**
• No CHANGELOG.md edit

Validation

• npm run typecheck (pre-existing, unrelated failures confirmed via git stash diff — none touch changed files)
• npx vitest run test/unit/guardrail-config.test.ts test/unit/focus-manifest.test.ts test/unit/predicted-gate.test.ts test/unit/agent-actions.test.ts test/unit/queue-2.test.ts test/unit/queue-3.test.ts test/unit/queue-lifecycle-guards.test.ts test/contract/live-gate-parity.test.ts test/contract/engine-parity.test.ts — all green
• npm run test:coverage (unsharded, full suite) — exit 0, no failures; src/review/guardrail-config.ts isolated coverage: 100% statements/branches/functions/lines
• npx tsx scripts/check-engine-parity.ts — no drift between the host/engine guardrail-config.ts twins (only pre-existing, unrelated node_modules version-skew warning)
• npx tsx scripts/check-docs-drift.mjs — passes, all RepositorySettings/FocusManifest fields documented
• npm run ui:openapi + npm run ui:openapi:settings-parity — regenerated and verified
• npm audit --audit-level=moderate — 0 vulnerabilities
• git diff --check — clean

Safety

• No secrets in code/comments/tests
• Default behavior unchanged for every repo that doesn't set the new flag (verified via regression test matching pre-fix(review): preserve invariant guardrails #3943-revert semantics)
• New opt-in path fully unit-tested (both true/false/absent branches, plus the parse+resolve pipeline)

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 95.05%. Comparing base (24800c6) to head (19a5710).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...s/gittensory-engine/src/review/guardrail-config.ts	66.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5708      +/-   ##
==========================================
- Coverage   95.05%   95.05%   -0.01%     
==========================================
  Files         581      581              
  Lines       46157    46159       +2     
  Branches    14808    14810       +2     
==========================================
+ Hits        43874    43875       +1     
  Misses       1523     1523              
- Partials      760      761       +1     

Flag	Coverage Δ
shard-1	43.97% <71.42%> (-0.01%)	⬇️
shard-2	35.67% <85.71%> (+0.07%)	⬆️
shard-3	32.32% <57.14%> (+0.03%)	⬆️
shard-4	33.61% <42.85%> (+0.59%)	⬆️
shard-5	31.01% <42.85%> (-0.59%)	⬇️
shard-6	44.47% <42.85%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/gittensory-engine/src/focus-manifest.ts	99.10% <100.00%> (ø)
src/openapi/schemas.ts	100.00% <ø> (ø)
src/review/guardrail-config.ts	100.00% <100.00%> (ø)
src/types.ts	100.00% <ø> (ø)
...s/gittensory-engine/src/review/guardrail-config.ts	87.50% <66.66%> (-12.50%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.