feat(sync): auto-file upstream drift issues with dedupe fingerprints

[JSONbored]

Parent roadmap: #82

Background

If upstream Gittensor changes are easy to miss, Gittensory can silently drift away from the rules it is supposed to explain. Operators should get one clear issue per meaningful drift event, not duplicate noise.

Goal

Add admin-gated automation that opens or updates a GitHub issue when upstream drift requires Gittensory work.

Current Behavior

Drift detection is not tied to issue creation or durable maintainer follow-up.

Desired Behavior

When enabled, drift automation files or updates a single issue keyed by a stable fingerprint and assigns/routs it to maintainers.

Implementation Requirements

• Add GITTENSORY_AUTO_FILE_DRIFT_ISSUES or equivalent admin flag.
• Generate issue body with changed upstream source, severity, affected Gittensory areas, and suggested tests.
• Search for open drift issue by fingerprint before creating a new issue.
• Update existing issue when the same drift persists or expands.
• Keep automation rate-limited and audit logged.

Public/Private Output Boundaries

Auto-filed issues can mention scoring constants and source file names, but must not include secrets, tokens, private session data, wallet/hotkey data, or payout guarantees.

Acceptance Criteria

• Disabled flag records drift but does not file issues.
• Enabled flag creates one issue for new drift.
• Repeated drift updates the existing issue.
• API failures do not create speculative issues.
• Issue bodies include testing requirements.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally to avoid CI variance.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, queue pressure, source-upload safety, public/private boundaries, or upstream drift.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.
• MCP/local tooling must prove source contents are not uploaded.

Additional Test Scenarios

• Duplicate fingerprint fixture.
• New drift fixture.
• Existing issue update fixture.
• GitHub API failure fixture.
• Audit redaction regression.