fix(orb): confirmed_miner command-authorization widening is dead for 6 of 7 @loopover PR commands

[JSONbored]

⚠️ Definition of Done: this issue must be completed in full, in a single PR. Do not split this
work across multiple PRs, and do not defer any Deliverable below to a follow-up issue. A PR that
satisfies only some of the Deliverables, stubs a required test, or leaves a checkbox
partially-done does NOT resolve this issue and will be closed.

Context

src/queue/processors.ts:12005 (the review command) is the only call to
authorizePrActionActor that passes needsMinerDetection: true. Every sibling command call omits
it: gate-override (:11747), resolve (:11952), pause (:12061), resume (:12104), explain
(:12171), and generate-tests (:12252, and explicitly false at :12961). Without
needsMinerDetection: true, the official miner-status field (:13107) stays undefined, and
evaluateCommandAuthorization always falls into minerStatus === undefined → "miner_detection_unavailable" whenever a pr_author/confirmed_miner role match would otherwise
apply.

But the shipped authorization policy
(packages/loopover-engine/src/settings/command-authorization.ts:25-28,49) explicitly documents all
six of these commands as maintainer-widenable to confirmed_miner via a repo's
commandAuthorization override.

Consequence: any repo that customizes commandAuthorization to widen gate-override, resolve,
pause, resume, explain, or generate-tests to allow confirmed_miner authors gets a command
that can never actually authorize a confirmed miner for that widened role — the documented
customization is a dead feature for these six call sites, since miner status is never even computed
for them.

Requirements

• Pass needsMinerDetection: true to authorizePrActionActor at all six call sites listed above,
  matching the already-correct review command call site.
• Do not change any other authorization behavior for these commands.

Deliverables

• All six call sites (gate-override, resolve, pause, resume, explain,
  generate-tests) pass needsMinerDetection: true.
• A new test: a repo with commandAuthorization: { commands: { pause: ["confirmed_miner"] } };
  a confirmed-miner PR author invokes @loopover pause; assert the command is now authorized —
  currently denied with miner_detection_unavailable.
• A second new test does the same for at least one more of the five other commands (pick one
  with a materially different code path, e.g. generate-tests, to confirm the fix generalizes).

All three Deliverables are required in the same PR — fixing only some of the six call sites does
not resolve this issue.

Test Coverage Requirements

src/** is measured by codecov/patch (99%+ target, branch-counted). The new tests must exercise
the previously-dead confirmed_miner-widening path directly for at least two of the six commands.

Expected Outcome

A repo's documented commandAuthorization override widening any of these six commands to
confirmed_miner actually authorizes a confirmed miner, matching the shipped policy's own stated
contract.

Links & Resources

• src/queue/processors.ts:11747,11952,12061,12104,12171,12252,12961 (the six call sites needing
  the fix), :12005 (the already-correct review command to mirror), :13107
  (evaluateCommandAuthorization)
• packages/loopover-engine/src/settings/command-authorization.ts:25-28,49 (the documented,
  currently-dead widening policy)

[linear-code]

JSO-6030