R2 bucket migration (2 live buckets) and the public /gittensory/shot route

[JSONbored]

Problem: Two live Cloudflare R2 buckets carry the old brand name and are not declared in wrangler.jsonc or tracked by any of the milestone's existing rebrand issues: gittensory-review-audit (created 2026-06-22), whose name strongly suggests it's the review-audit ledger/artifact store, and gittensory-visual-capture-public (created 2026-07-08), whose -public suffix means its objects are directly linked from public-facing content — the screenshots the visual-capture rollout embeds in PR and review comments. R2 buckets cannot be renamed in place, so this sits in the same risk class as the D1 migration in #4767. Compounding it, the public HTTP route that serves those screenshots, GET /gittensory/shot, is itself named after the old brand and is already baked into potentially many previously-posted, effectively immutable GitHub PR comments.

Area: Infra / Data

Proposal:

Open question (needs a maintainer decision before starting): Old PR comments containing /gittensory/shot image links can't be edited retroactively at any scale. Should the old route path be kept as a permanent alias indefinitely, rather than the time-limited grace window used elsewhere in this rebrand? If not permanent, what's the intended sunset plan for the comments that predate it?

Provision new R2 buckets for both gittensory-review-audit and gittensory-visual-capture-public, back-fill/copy all existing objects into them, and repoint every binding and consumer — including src/review/visual/shot.ts (the route handler), src/auth/rate-limit.ts (~line 126), src/selfhost/blob-store.ts, src/selfhost/s3-blob-store.ts, src/review/unified-comment-bridge.ts (which posts these exact /gittensory/shot URLs into PR comments as markdown <img> tags), and src/env.d.ts — to the new buckets. Note that #4762 only covers the top-level domain (loopover.ai wiring + OAuth callback); it does not cover sub-path route segments like /gittensory/shot, so this route's fate is in scope here, not there. Once the open question above is settled, keep /gittensory/shot resolving (permanently or per that decision) — backed by the gittensory/shots/<hash>.png key prefix migrated into the new bucket — before retiring the old buckets.

Deliverables:

• New R2 buckets live and serving production traffic in place of gittensory-review-audit and gittensory-visual-capture-public.
• All existing objects copied/back-filled with zero data loss.
• Every binding and consumer (src/review/visual/shot.ts, src/auth/rate-limit.ts, src/selfhost/blob-store.ts, src/selfhost/s3-blob-store.ts, src/review/unified-comment-bridge.ts, src/env.d.ts) repointed to the new buckets.
• A documented resolution of the permanent-alias open question, with the old /gittensory/shot route behaving accordingly.

Acceptance criteria:

• Zero data loss, verified by object-count comparison between old and new buckets.
• Every previously-posted /gittensory/shot image link in existing PR/review comments still resolves after the migration.
• The maintainer's decision on permanent-alias vs. grace-window is documented and implemented before old buckets are retired.

Test scenarios:

• Dry-run the object copy against a staging or sampled subset of both buckets before touching production.
• Fetch a known pre-migration /gittensory/shot?key=... URL (one already posted in a real PR comment) after cutover and confirm the image still renders.
• Verify new writes through unified-comment-bridge.ts land in the new bucket and produce working links.

Resources:

• src/review/visual/shot.ts
• src/auth/rate-limit.ts (~line 126)
• src/selfhost/blob-store.ts
• src/selfhost/s3-blob-store.ts
• src/review/unified-comment-bridge.ts
• src/env.d.ts

Boundaries:

• Leave every reference to the separate gittensor network's own domain/name untouched — gittensor (no trailing Y) is the permanent Bittensor SN74 brand and is never renamed; only the gittensory-prefixed bucket names and route path in scope here change.
• Do not rename or remove the old /gittensory/shot route until the permanent-alias open question above is resolved — old PR comments cannot be edited to point at a new path.
• This migration is scoped to the two R2 buckets and the route/consumers listed above; it does not cover the top-level domain, which is Wire loopover.ai as a live secondary domain #4762's scope.

---

Part of #4761.

[linear-code]

JSO-3792