Per-operator private-config seam (runtime rubric/guardrails/params)

[JSONbored]

Part of #983.

Context

The locked privacy model is "open-source engine + private runtime config": the real rubrics, trusted knowledge, guardrail globs, and gameable params (confidenceFloor/scopeCap/reputation) must load at RUNTIME and never be committed (the keep-internals-private constraint). gittensory today has NO runtime private-overlay seam — it resolves .gittensory.yml over DB over defaults into a flat RepositorySettings (resolveRepositorySettings, src/settings/repository-settings.ts). reviewbot's loadReviewConfig/applyReviewConfigOverlay (+ review-config.example.json) is the loader to map in. The home for the private config is decided in #1017 (KV hosted vs D1/.gittensory.yml). .gittensory.yml stays the PUBLIC surface; the rubric stays private. Land this BEFORE migrating any rubric, or the OSS flip leaks the tuning.

Deliverables

• Implement the private-config loader: rubric/knowledge/guardrail-globs + gameable params load at runtime from KV (hosted) or a mounted REVIEW_CONFIG_JSON (self-host), one file per project, fail-safe to a committed placeholder.
• Map reviewbot's loadReviewConfig/applyReviewConfigOverlay + review-config.example.json into gittensory's resolveRepositorySettings so .gittensory.yml stays the public surface and the private rubric overlays at runtime.
• Ensure NO private rubric / gameable param is ever committed or surfaced; a missing private config fails safe to the placeholder (no crash, conservative defaults).
• Add tests: overlay precedence (private over .gittensory.yml over DB over defaults); fail-safe to placeholder when the private config is absent.

Acceptance criteria

• Private rubric/knowledge/guardrail-globs/gameable params load at runtime and are never committed; .gittensory.yml remains the only public-facing config.
• A missing or unreachable private config fails safe to the committed placeholder with conservative defaults.

Notes

• Milestone: M1
• Depends on: Infra bindings + adapters (LOCK DO, Vectorize, R2, Browser, private-config home, queue) #1017
• This is the most security-sensitive convergence task (keep-internals-private). It MUST precede any rubric migration so the OSS flip can never leak the tuning.
• Coordinate logging with the Sentry seam (Sentry: privacy scrubber (beforeSend redaction) — non-negotiable #1000/Sentry: review-pipeline tracing + per-installation tagging #1001) so private config never lands in error reports.

[JSONbored]

Closing as completed (2026-07-01 issue audit): Per-operator private-config seam shipped (src/selfhost/private-config.ts + guardrail-config.ts, #1390).