Lower-priority duplicate cleanup batch

[JSONbored]

Context

Part of the review-stack architecture audit (parent epic — duplication dimension). Smaller-blast-radius
duplicates worth a follow-up sweep, bundled into one issue since each is a quick, independent fix:

1. isCommentLine — 5 bodies

review-enrichment/src/analyzers/{a11y-regression,unsafe-any,hardcoded-url,complexity, floating-promise}.ts. 3 of the 5 (unsafe-any.ts, complexity.ts, floating-promise.ts) are already
byte-identical (//|/\*|\*); hardcoded-url.ts deliberately adds # (shell/Python) and
a11y-regression.ts deliberately adds <!--|import\b|from\b (JSX-aware) — these two look
intentional, not accidental drift. Fix: extract a shared base regex for the 3 that already match,
leave the 2 intentionally-different ones as documented overrides of the shared base.

2. authoritativeContributorRepoStats — 4 copies

src/mcp/server.ts:3776, src/api/routes.ts:5184 (identical), src/queue/processors.ts:15224,
src/services/decision-pack.ts:1797 (both only differ by prettier line-wrap/type-spelling, verified
functionally identical). Currently harmless. Fix: consolidate into decision-pack.ts + 3 re-exports.

3. hasUnsafeWildcardCount — a 3rd, invisible-to-tooling private copy

The guarded pair src/signals/change-guardrail.ts:62 ↔
packages/gittensory-engine/src/signals/change-guardrail.ts:62 is fine (covered by the existing
engine-parity signals auto-discovered pairs). But packages/gittensory-engine/src/scoring/preview.ts:37
is a 3rd, private, non-exported copy inside the engine package that the drift-check can't see by
construction (it only compares host-vs-engine, never engine-internal duplicates). Fix: have
preview.ts import from change-guardrail.ts instead of redefining.

Acceptance criteria

• All 3 duplicate clusters consolidated to a single implementation each.
• No behavior change; existing tests pass unmodified (or updated only for import paths).

[linear-code]

JSO-3385