fix(queue): override the Gate on the live PR head, not the stale cached SHA

[JSONbored]

Summary

@gittensory gate-override <reason> built the neutral check-run from the cached pr.headSha (via buildAuthorizedPrActionAdvisory). If a commit landed between the override comment and its processing, the stored head was stale — so the override was posted on a phantom old SHA. The result: a silent no-op on the LIVE head, whose Gittensory Gate check stays blocking and keeps the PR unmergeable (audit #16). The override looks like it worked (the bot confirms) but the maintainer's escape hatch does nothing.

The fix re-fetches the live head before posting:

• New resolveOverrideHeadSha re-fetches the live head via fetchLivePullRequestHeadSha (GET /pulls/{n}) and overrides that commit — the neutral check-run is per-commit by design (its own summary says "a new push re-evaluates it").
• Threaded through the advisory ({ ...pr, headSha: liveHead }) so the check-run and the audit event target the right SHA.
• Fail-open: an unreadable live fetch returns the cached head, so a transient GitHub hiccup never strands the override — it just targets the stored SHA as before. Mirrors the rebase path's live re-fetch in prReadyForReview.
• The gate_overridden audit metadata now records both the resolved headSha and the cachedHeadSha, so a stale-head correction is observable.

No GitHub issue — internal review-subsystem audit finding (#16). Self-contained fix to the live-merge / override path.

Scope

• Backend (src/) only — src/queue/processors.ts, src/github/backfill.ts
• No API/schema, DB/migration, wrangler.jsonc, or UI change
• Narrow, one coherent change

Validation

• npm run test:ci — green (4464 passed | 4 skipped)
• npm run test:coverage — every changed line and branch covered (verified against coverage/lcov.info), incl. the previously-uncovered safeReason empty-reason fallback in the same function
• npm audit --audit-level=moderate — 0 vulnerabilities
• npm run typecheck / ui:typecheck — clean; git diff --check clean
• New tests: resolve-override-head-sha.test.ts (token-mint success / throw→public-token fallback / live-fetch fail-open / missing-head fail-open); queue.test.ts — a live-head-differs override (asserts the PATCH targets the live SHA's Gate run, never the stale one) and an unresolved-head fail-safe.

Safety

• No secrets / wallets / hotkeys / coldkeys / trust scores / reward values added
• Fail-open (cached head on an unreadable fetch); authorization path unchanged (still real repo-permission, never author_association)
• No public-surface term leakage

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.36%. Comparing base (fba397a) to head (abba408).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1408      +/-   ##
==========================================
+ Coverage   95.34%   95.36%   +0.01%     
==========================================
  Files         192      192              
  Lines       20770    20777       +7     
  Branches     7508     7511       +3     
==========================================
+ Hits        19804    19814      +10     
  Misses        383      383              
+ Partials      583      580       -3     

Files with missing lines	Coverage Δ
src/github/backfill.ts	92.95% <100.00%> (+0.01%)	⬆️
src/queue/processors.ts	88.17% <100.00%> (+0.29%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.