feat(commands): wire @gittensory generate-tests PR-comment command

[JSONbored]

Part of #4189. Depends on #4194.

Revised 2026-07-08: authorization tightened to maintainer-only (see the epic's updated Context) — a repo could grant a contributor/miner collaborator-level push access, and that tier must not be able to invoke test generation for their own scored PR. This is the first command in the catalog scoped to ["maintainer"] alone rather than ["maintainer", "collaborator", ...].

Context

The @gittensory <verb> PR-comment command surface already exists and is actively growing — review, pause, and resume are wired as of the recent feat(commands): wire @gittensory review and resume PR-comment commands (#4175) change:

• Catalog: GITTENSORY_ACTION_COMMAND_CATALOG (src/github/commands.ts:65), which GittensoryActionCommandName (commands.ts:103) derives from automatically.
• Cost accounting: AI_COST_BEARING_COMMANDS (commands.ts:316) — commands that trigger an LLM call are registered here.
• Authorization: DEFAULT_COMMAND_AUTHORIZATION_POLICY (src/settings/command-authorization.ts:3) maps each command to the GitHub roles allowed to invoke it. The role type is CommandAuthorizationRole = "maintainer" | "collaborator" | "pr_author" | "confirmed_miner" (src/types.ts:1083) — note pr_author is already a distinct, separately-classified role from maintainer/collaborator.
• Dispatch: three parallel if (eventName === "issue_comment" && (await maybeProcess*Command(...))) checks in the webhook handler (src/queue/processors.ts:5621-5623), each calling a maybeProcess<Verb>Command function that follows the same classify → authorize → dispatch → audit shape (see maybeProcessReviewCommand, processors.ts:11105).
• Every existing command today uses ["maintainer", "collaborator", ...] — none is scoped to maintainer alone yet.

Requirements

• Register { id: "generate-tests", title: "Generate E2E tests", description: "..." } in GITTENSORY_ACTION_COMMAND_CATALOG (commands.ts:65).
• Register "generate-tests" in AI_COST_BEARING_COMMANDS (commands.ts:316) — this command triggers feat(review): LLM core to turn a PR diff into Playwright E2E test source #4191's LLM call.
• Add a maintainer-only authorization entry to DEFAULT_COMMAND_AUTHORIZATION_POLICY.commands (command-authorization.ts:3): ["maintainer"] — deliberately excluding collaborator, pr_author, and confirmed_miner. This is a genuine tightening beyond every other command in the catalog, justified by this command's much heavier blast radius (it can write a real commit to a PR branch via feat(review): delivery escalation for generated E2E tests — commit / follow-up-PR modes #4197) and the direct scoring-integrity risk if a contributor-tier actor could invoke it on their own PR.
• Do not add a separate "deny if actor is the PR's own author" check on top of the role restriction — that would incorrectly block a maintainer's own legitimate self-authored PR. Role-tier alone (genuine maintainer/owner-level GitHub permission, never collaborator-level) is the correct and sufficient gate.
• Implement maybeProcessGenerateTestsCommand, mirroring maybeProcessReviewCommand's classify → authorize → dispatch → audit shape exactly (parse the mention → classifyPrCommandRequest → authorizePrActionActor → on denial, record a *_denied audit/usage event → on success, post a confirmation comment via the existing sanitizePublicComment + command-comment-marker convention → dispatch the actual work (invoking feat(review): LLM core to turn a PR diff into Playwright E2E test source #4191's generation core, then feat(review): delivery escalation for generated E2E tests — commit / follow-up-PR modes #4197's commit-delivery path) → record a *_completed audit/usage event).
• Wire the new function into the issue_comment dispatch chain (processors.ts:5621-5623) alongside the existing three.
• The command must work regardless of whether manifest_missing_tests fired (feat(review): auto-trigger E2E test generation on the manifest_missing_tests signal #4196) — an explicit ask is always honored if the feature is enabled for the repo.

Deliverables

• generate-tests registered in the command catalog, cost-bearing set, and authorization policy at ["maintainer"] only.
• maybeProcessGenerateTestsCommand implemented and wired into the dispatch chain.
• Tests covering: a genuine maintainer/owner succeeds; a collaborator-tier actor (including one who is also the PR's own author) is denied and audited; a confirmed_miner/pr_author-only actor is denied and audited; the command works even when manifest_missing_tests hasn't fired.

Expected outcome

Only an actual repo maintainer can invoke @gittensory generate-tests on any PR — never the PR's own author acting merely as a contributor/collaborator, and never an autonomous miner — closing the exact loophole a click-to-generate button would otherwise open.

Resources / examples

• src/github/commands.ts:65-107, 316-328
• src/settings/command-authorization.ts:3-27
• src/types.ts:1083 (CommandAuthorizationRole)
• src/queue/processors.ts:5621-5623, 11105 (maybeProcessReviewCommand)

Effort

M — new command function, but following an established, three-times-proven shape, plus one deliberate new authorization tier.

[linear-code]

JSO-3227