fix(review): add a per-actor rate ceiling on the unlinked-issue-match AI verifier, ahead of its existing post-hoc repeat-escalation check

[JSONbored]

Context

A maintainer review-stack × Autonomous Miner System (AMS) integration audit (2026-07-09) found that the unlinked-issue-match AI verifier — unlike every sibling free-AI-advisory feature — has no cost ceiling on how often it runs per actor.

Evidence

• src/review/unlinked-issue-guardrail.ts:76-127 — resolveUnlinkedIssueMatchDisposition runs its config/linked-issue-count short-circuits, then unconditionally loops candidates into verifyUnlinkedIssueMatch — no actor-level call-frequency check before this loop.
• src/signals/unlinked-issue-candidates.ts:31 — MAX_CANDIDATES = 3 bounds cost per PR only, not per actor over time.
• src/review/unlinked-issue-guardrail.ts:52-55 — the repeat-check (hasPriorUnlinkedIssueMatch) only runs after a candidate has already cleared the AI verifier — i.e. after the AI cost is already spent, so it cannot prevent the spend.
• By contrast, sibling free-AI-advisory features (src/services/ai-slop.ts:199-208, src/services/linked-issue-satisfaction-run.ts) explicitly consult the shared AI_DAILY_NEURON_BUDGET before spending — src/review/unlinked-issue-match.ts's verifyUnlinkedIssueMatch calls env.AI.run directly with no budget check of any kind, not even the shared global ceiling its siblings use.

Why this matters for the Autonomous Miner System

For an occasional human abuser this is a non-issue — natural submission rate bounds the cost. For a machine-paced fleet opening many unlinked PRs per hour across an install's repos, this AI-verifier cost is genuinely unbounded per-actor even though it's bounded per-PR: exactly the "built for occasional human abuse, not fleet-paced abuse" pattern that breaks at AMS scale, and a real spend/availability risk independent of any anti-farming concern.

Deliverables

• Add a per-actor rate ceiling (or at minimum wire this path into the existing shared AI_DAILY_NEURON_BUDGET check its siblings already use) before verifyUnlinkedIssueMatch is invoked
• Decide the fallback behavior when an actor exceeds the ceiling (skip the AI check and fall back to the deterministic disposition, vs. queue/delay)
• Tests: budget-exceeded fallback path, normal-actor path unaffected, existing per-PR MAX_CANDIDATES bound unaffected
• Docs: note the new ceiling alongside the guardrail's other config knobs

---

Surfaced by a maintainer review-stack × AMS integration audit (2026-07-09). Related: #3555 (the guardrail's origin issue), #2344 (miner-side rate-limit/backoff wiring — the write-side counterpart to this read/AI-cost-side gap).

[linear-code]

JSO-3351