feat(miner-manage): maintainer-gate verdict watcher (read-only, webhook or poll)

[JSONbored]

packages/gittensory-miner/lib/ci-poller.js (#2323) already implements a reusable, tested polling+backoff engine (pollCheckRuns) with exponential backoff (backoffDelayMs, ci-poller.js:150-153), PR-head-drift re-fetch on retry, and pagination handling. But it only watches GitHub's generic Checks API (/repos/{owner}/{repo}/commits/{sha}/check-runs) and aggregates every check-run into one of success/failure/neutral/pending (aggregateConclusion, ci-poller.js:142-148). manage-poll.js then maps that blind aggregate straight into a "gate verdict" (mapPollConclusionToGateVerdict, manage-poll.js:22-31: success→pass, failure→block, anything else→advisory) — a heuristic proxy, not the actual gittensory gate disposition.

The real gate verdict isn't exposed as a GitHub check-run at all. Searching src/github/ and src/review/ for a gate-owned check-run name (checks.create/a hardcoded "gittensory" check context) turns up nothing — the authoritative verdict is server-internal gate_decision state (see src/selfhost/orb-collector.ts's FLEET_QUERY, which reads event_type = 'gate_decision' rows from review_audit) and is surfaced to contributors through the public gittensory API instead: /v1/contributors/{login}/open-pr-monitor (ContributorOpenPrMonitorSchema, src/openapi/schemas.ts:394-427) and /v1/repos/{owner}/{repo}/pulls/{number}/maintainer-packet (PullRequestMaintainerPacketSchema, src/openapi/spec.ts:536-538). So a real maintainer-gate-verdict watcher needs to poll one of those endpoints, not raw check-runs — reusing ci-poller.js's backoff/attempt-loop shape (injectable fetchFn/sleepFn, minIntervalMs/maxIntervalMs/maxAttempts, so it stays unit-testable the same way) but pointed at the gittensory API instead of api.github.com.

This is deliberately read-only: it only watches and records a verdict locally (via the event-ledger from the sibling schema issue), it does not comment, close, or otherwise act on GitHub.

Deliverables

• packages/gittensory-miner/lib/gate-verdict-poller.js (or extend ci-poller.js with a sibling export) polling /v1/contributors/{login}/open-pr-monitor or /v1/repos/{owner}/{repo}/pulls/{number}/maintainer-packet for the real gate disposition, reusing ci-poller.js's backoff/attempt-loop shape (injectable fetchFn, sleepFn, minIntervalMs, maxIntervalMs, maxAttempts)
• A pure mapper from the API response's gate fields to a small typed verdict (e.g. merge | close | hold | pending) — replacing manage-poll.js's current CI-conclusion-as-proxy heuristic (mapPollConclusionToGateVerdict, manage-poll.js:22-31) as the source of the gateVerdict field it already writes into manage_pr_update events
• No GitHub token required for this path (the gittensory API is the target, not api.github.com) — document what auth, if any, the polled endpoint needs for a third-party contributor's own PRs
• Unit tests mirroring test/unit/miner-ci-poller.test.ts's style (injected fetchFn/sleepFn, no real network) covering: a clean merge/close/hold verdict, a pending/not-yet-decided response, and backoff behavior while pending
• Leave ci-poller.js's existing CI-check-run polling untouched — CI state and gate verdict are two different signals and manage-poll.js can keep recording both

References

• packages/gittensory-miner/lib/ci-poller.js:150-153,194-228 (backoffDelayMs, pollCheckRuns — the backoff/attempt-loop shape to reuse)
• packages/gittensory-miner/lib/manage-poll.js:22-42 (mapPollConclusionToGateVerdict/mapPollConclusionToOutcome — the current CI-as-proxy heuristic this replaces as the verdict source)
• src/selfhost/orb-collector.ts:111-146 (FLEET_QUERY — confirms the real verdict lives in gate_decision rows, not GitHub check-runs)
• src/openapi/schemas.ts:394-427 (ContributorOpenPrMonitorSchema)
• src/openapi/spec.ts:536-538,568-573 (maintainer-packet and open-pr-monitor endpoint registrations)
• test/unit/miner-ci-poller.test.ts (the existing test style/pattern to mirror)

[linear-code]

JSO-3260