feat(review): add @gittensory plan — issue → implementation plan command

[JSONbored]

Summary

A CodeRabbit-parity planning command. Flag-gated by GITTENSORY_REVIEW_PLANNER (default OFF → byte-identical deploy). When ON, a maintainer who comments @gittensory plan on an issue gets a concise, actionable implementation plan generated from the issue text via Workers AI, posted as an issue comment so a contributor (or their agent) has a concrete starting point.

Safety contract

• flag-OFF (default) — the handler returns before parsing, so @gittensory plan falls through to the existing mention path exactly as today.
• flag-ON — maintainer-only via the real repo permission (resolveRealRepoPermissionAssociation), never the spoofable author_association. The model sees only the already-public issue title + body; the output is public-safe sanitized before posting; any model/auth/error path degrades to a recorded no-op (no comment, an audit skip).

Changes

• src/review/planner.ts (new) — isPlannerEnabled (flag); isPlanCommand (parse); classifyPlanCommandRequest (pure, exhaustively unit-tested eligibility guard — wrong action / bot / missing repo·issue·installation·actor / a PR rather than an issue — so the processor carries a single ok branch); generateIssuePlan (bounded Workers AI call, fail-safe null); buildIssuePlanComment (public-safe render).
• src/queue/processors.ts — maybeProcessPlanCommand wired into the issue_comment flow (before the mention Q&A path); a skip audit + product-usage event for every non-acting path, a generated event on success.
• wrangler.jsonc + worker-configuration.d.ts + src/env.d.ts — the GITTENSORY_REVIEW_PLANNER flag (default OFF).

No linked issue — a config-as-code review enhancement in the CodeRabbit-parity series (follows #1347/#1350/#1353/#1357).

Scope

• src/ + wrangler.jsonc + regenerated worker-configuration.d.ts (Phase 4); no migration / OpenAPI (webhook-only, no routes)
• Flag-gated + OFF by default (new capability convention); no secrets/site/CNAME/lovable; no CHANGELOG

Validation

• npm run test:ci — exit 0; 4386 tests pass
• npm audit --audit-level=moderate — 0 vulnerabilities
• Every changed src/ line + branch covered (lcov BRDA across planner.ts, processors.ts) — src/env.d.ts is types-only (Codecov-ignored)
• Tests: planner unit (flag, parse, classifyPlanCommandRequest all guards, generateIssuePlan ok/empty/unavailable/throws, render); integration (maintainer posts a plan; flag-OFF byte-identical + AI never called; non-maintainer denied; non-plan comment declined; PR-comment skipped; no-plan fail-safe)

Safety

• Maintainer-only on real permission; public-safe-sanitized output from public-only input; fail-safe no-op on any error
• OFF by default → deploy byte-identical; activation is a single flag flip

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 96.66667% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 95.33%. Comparing base (2028570) to head (bae763b).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/review/planner.ts	94.44%	0 Missing and 2 partials ⚠️

❌ Your patch status has failed because the patch coverage (96.66%) is below the target coverage (97.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1360   +/-   ##
=======================================
  Coverage   95.32%   95.33%           
=======================================
  Files         190      191    +1     
  Lines       20562    20622   +60     
  Branches     7425     7447   +22     
=======================================
+ Hits        19601    19660   +59     
  Misses        378      378           
- Partials      583      584    +1     

Files with missing lines	Coverage Δ
src/queue/processors.ts	87.97% <100.00%> (+0.33%)	⬆️
src/review/planner.ts	94.44% <94.44%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.