Stage and remove the derived-only gateCheckMode field (naming sprawl, #5355 follow-up)

[JSONbored]

Context

Part of the #5355 root-cause fix for the gate.enabled/gate.checkMode config-as-code ambiguity (2026-07 Orb Review Agent check-run incident). While fixing that, this repo's gateCheckMode DB column/type field was audited as a related-but-distinct piece of naming sprawl:

• gateCheckMode: "off" | "enabled" (src/types.ts, src/db/schema.ts) is a derived, read-back-only value (see src/db/repositories.ts around the #4618 comments): gateCheckMode = reviewCheckMode === "disabled" ? "off" : "enabled". It has not been an independent write input since Reduce redundant config surface: linked-issue knob, gateCheckMode, label fields #4618 — every write path derives it from reviewCheckMode.
• Despite that, it still appears in 447 occurrences across 48 files repo-wide (production code + ~300 test-fixture literals), including API response shapes (GithubAppBehavior.gateCheckMode, buildInstallationRepairDiagnostics, activation endpoint responses) and doc/example references.
• The field name itself continues the exact enabled/checkMode naming collision pattern that caused the original incident: a reader can reasonably (and incorrectly) assume gateCheckMode is a third, independently-settable knob rather than a computed simplification of reviewCheckMode.

Requirements

1. Stage 1 (safe, mechanical): Mark gateCheckMode as @deprecated wherever it's exposed in a public type/API surface (GithubAppBehavior, activation endpoint responses, RepositorySettings if applicable), pointing readers at reviewCheckMode as the source of truth. No behavior change.
2. Stage 2 (removal, separate PR(s) from Stage 1):
   • Audit every one of the 447 occurrences to confirm each is a read of the derived value (not a hidden independent write path) before touching it.
   • Remove the DB column via a proper migrations/NNNN_*.sql (drop or backfill-then-drop, per whatever npm run db:schema-drift:check requires).
   • Remove gateCheckMode from RepositorySettings/GithubAppBehavior/API response shapes, updating every consumer to read reviewCheckMode (+ shouldPublishReviewCheck()) directly.
   • Update or delete the ~300 test-fixture literals that reference it.
   • Regenerate npm run ui:openapi / npm run cf-typegen as needed.

Deliverables

• Stage 1: a small, low-risk PR (or folded into another in-flight PR) adding deprecation markers only.
• Stage 2: a dedicated migration PR (or a short PR series, given the ≤10-file preference) that fully removes gateCheckMode, with npm run test:ci green and no dangling references (grep -rn "gateCheckMode" returns zero hits outside historical CHANGELOG/commit messages).

Expected outcome

reviewCheckMode (required | visible | disabled) becomes the single, unambiguous source of truth for review-check publish behavior everywhere in the codebase — no parallel derived field with a confusingly similar name left for a future reader (or a future incident) to misread as independently configurable.

Links & resources

• Root-cause epic/issue: Fix gate.enabled/gate.checkMode ambiguity at the code level (root cause of the Orb Review Agent check-run incident) #5355
• Prior fix that made gateCheckMode derived-only: Reduce redundant config surface: linked-issue knob, gateCheckMode, label fields #4618
• src/db/repositories.ts (search #4618) — the current derivation logic
• src/signals/registration-readiness.ts (GithubAppBehavior.gateCheckMode) — a representative public-surface consumer
• src/github/backfill.ts (buildInstallationRepairDiagnostics) — another consumer

Non-goals for this issue

• This is explicitly not blocking or required for Fix gate.enabled/gate.checkMode ambiguity at the code level (root cause of the Orb Review Agent check-run incident) #5355's own fix (the gate.enabled/gate.checkMode YAML config ambiguity is fully independent of this DB-level field and is fixed separately).
• Stage 2 should not be attempted as a single large PR given the blast radius (447 occurrences / 48 files) — split as needed to respect normal PR-size discipline.

[linear-code]

JSO-3807