fix(review): headline a held PR as held, not Closed, when the disposition won't close it

[JSONbored]

Summary

The unified PR comment derived its headline from the gate verdict, so a close verdict always rendered "Closed" — even when the disposition would NOT actually close the PR. Two cases mislabel the action (audit #8/#9, the #4220 comment↔action class):

• fix(docs): restore Nightward-style homepage flow #9 — an owner / automation-bot PR is never auto-closed, yet a close verdict headlined "Closed".
• feat(docs): refresh Gittensor-aligned homepage #8 — a guarded-path PR is held for owner review (not closed) unless a red required check forces the close, yet it headlined "Closed".

The fix threads the disposition's held-vs-closed reality into deriveUnifiedStatus:

• neverClosed (author is the repo owner or a protected automation bot) → a close verdict renders held.
• a guarded-path close (heldForReview) renders held unless ciState === "failed" — which mirrors the planner's redVerifiedRequiredCi (agent-actions.ts:316), the only thing that closes a guarded PR.
• a genuine contributor close (red required CI, or a non-guarded block) still headlines "Closed".

The disposition was already correct (it never closes these); only the comment text was wrong. This is the piece deferred from #1374, now done with the author + guard nuance modeled so a red-CI guardrail PR that does close is not mislabeled.

No GitHub issue — internal review-subsystem audit finding (#8/#9).

Scope

• Backend (src/) only — unified-comment.ts, unified-comment-bridge.ts, processors.ts
• No API/schema, DB/migration, wrangler.jsonc, or UI change
• Narrow, one coherent change

Validation

• npm run test:ci — green (4470 passed | 4 skipped)
• npm run test:coverage — every changed line and branch covered (verified against coverage/lcov.info)
• npm audit --audit-level=moderate — 0 vulnerabilities; typecheck/ui:typecheck clean; git diff --check clean
• New/updated tests: the full held-vs-closed matrix in deriveUnifiedStatus (owner/bot → held incl. red CI; guarded close → held unless red CI; genuine contributor close → Closed) and a bridge test that a gate-failure PR renders held under neverClosed. Corrected the prior test that asserted the old (buggy) "guarded close stays blocked".

Safety

• No secrets / wallets / hotkeys / coldkeys / trust scores / reward values added
• Comment-text-only change; the merge/close/hold action is unchanged
• No public-surface term leakage

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 71.42857% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 95.35%. Comparing base (9b69f3b) to head (55634ee).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/queue/processors.ts	33.33%	0 Missing and 2 partials ⚠️

❌ Your patch status has failed because the patch coverage (71.42%) is below the target coverage (97.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1412      +/-   ##
==========================================
- Coverage   95.36%   95.35%   -0.01%     
==========================================
  Files         192      192              
  Lines       20779    20786       +7     
  Branches     7512     7519       +7     
==========================================
+ Hits        19816    19821       +5     
  Misses        383      383              
- Partials      580      582       +2     

Files with missing lines	Coverage Δ
src/review/unified-comment-bridge.ts	95.12% <100.00%> (+0.06%)	⬆️
src/review/unified-comment.ts	98.03% <100.00%> (+0.03%)	⬆️
src/queue/processors.ts	88.03% <33.33%> (-0.14%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.