Implement upgrade-only ORB/AMS reputation bridge (pull, GitHub-login-keyed)

[JSONbored]

Context

#6208 decided the reputation-bridge design (see its pinned decision comment): GitHub-login-keyed, ORB-pulls-from-AMS, upgrade-only weighting, reusing track-record-summary.ts's existing privacy-safe TrackRecordPullRequestOutcome shape (no score/wallet/hotkey fields). This issue is the implementation.

Requirements

• New read path in src/review/submitter-reputation.ts (or a sibling module it calls into): given a GitHub login, attempt to fetch that login's AMS track-record summary from a local, operator-configured AMS endpoint.
• Pull-only, upgrade-only: the result may only ever move the computed ReputationSignal from neutral/low toward trusted — never the reverse. A submitter with no AMS data, or an AMS instance that's unreachable, gets exactly today's behavior (no regression, no new downgrade path).
• Fail-safe per this module's existing contract: any fetch error, timeout, or malformed response degrades to "no bonus signal applied" — must never throw into the gate, matching every other guard already in this file.
• Config-as-code, default OFF: gate the whole feature behind a new .loopover.yml toggle (follow LOOPOVER_REVIEW_REPUTATION's existing on/off pattern in src/review/reputation-wire.ts, or extend it) — byte-identical behavior when off.
• Never surface this signal publicly — inherits submitter-reputation.ts's existing STRICTLY INTERNAL contract as-is (no labels, no PR comments, no check-runs).
• Timeout-bounded (a slow/unreachable AMS instance must not slow down gate evaluation) — pick a short timeout (e.g. a few hundred ms) consistent with this codebase's other fail-safe external-read patterns.

Deliverables

• The pull + upgrade-only merge logic in submitter-reputation.ts (or a clearly-named sibling module).
• The .loopover.yml opt-in toggle, documented in .loopover.yml.example / config/examples/loopover.full.yml.
• Unit tests: no AMS data → unchanged signal; AMS data present and positive → signal upgrades (never downgrades even if AMS data were somehow negative); AMS endpoint unreachable/timeout/malformed → unchanged signal, no throw.

Test Coverage Requirements

99%+ Codecov patch coverage on the diff (src/**) — including the off-by-default branch, the timeout/error branch, and both the upgrade and no-op merge outcomes.

Expected Outcome

A repo running both ORB and AMS can, once an operator opts in, let a submitter's genuine AMS track record improve (never worsen) their ORB reputation standing — with zero behavior change for any repo that hasn't opted in or has no AMS installed.

Links & Resources

• Spec: bridge ORB's submitter-reputation signal with AMS's calibration/track-record data #6208 (design decision — read its pinned comment before starting)
• Epic: AMS + ORB combined-use synergy features (both installed on the same repo) #6206 (parent epic)
• src/review/submitter-reputation.ts, src/review/reputation-wire.ts (existing patterns to extend, not replace)
• packages/loopover-engine/src/track-record-summary.ts (the TrackRecordPullRequestOutcome shape to consume)

[linear-code]

JSO-4449