build(selfhost): wire Sentry source maps for release images

[JSONbored]

Summary

• No issue because this is maintainer release-image hardening for the existing self-host Sentry path.
• Generate and validate self-host source maps, upload them only from the maintainer release workflow, and build release images from the exact Sentry-injected bundle.
• Keep source maps out of the runtime image while documenting Sentry code mapping, required secrets/vars, official-image behavior, custom-image behavior, and troubleshooting.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥97% coverage of the lines AND branches you changed (aim for 98%+ on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Additional validation:

• npm run test:ci
• node scripts/build-selfhost.mjs --all && node scripts/validate-selfhost-sourcemap.mjs
• npx -y @sentry/cli@latest sourcemaps inject dist && node scripts/validate-selfhost-sourcemap.mjs
• docker buildx build --load -t gittensory:selfhost-default-test .
• docker buildx build --load --target runtime-prebuilt --build-arg GITTENSORY_VERSION=gittensory-selfhost@0.0.0-test -t gittensory:selfhost-prebuilt-test .
• Prebuilt image smoke: /health, /ready, and migration log checks passed.
• Runtime image inspection confirmed dist/server.mjs.map is absent and the prebuilt image contains the injected debug id plus baked GITTENSORY_VERSION.

If any required check was skipped, explain why:

• Live Sentry event verification is intentionally left for deployment of a release/prebuilt image; this PR does not touch the running self-host stack.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. No auth/session/CORS behavior changes.
• API/OpenAPI/MCP behavior is updated and tested where needed. Not applicable; no API/OpenAPI/MCP contract change.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. Not applicable; no UI behavior change.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository. Not applicable; docs/build workflow only.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

State / title	JPG/PNG evidence
Not applicable	No visible UI change; operator Markdown and release workflow only.

Notes

• This does not publish an official image by itself. The Sentry upload path is dormant until the maintainer release workflow runs from a selfhost-v* tag or manual dispatch.
• The source map is uploaded as a Sentry release artifact and is not copied into the runtime image.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.58%. Comparing base (6228967) to head (86f9527).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1721   +/-   ##
=======================================
  Coverage   95.58%   95.58%           
=======================================
  Files         204      204           
  Lines       22314    22316    +2     
  Branches     8066     8067    +1     
=======================================
+ Hits        21329    21331    +2     
  Misses        408      408           
  Partials      577      577           

Files with missing lines	Coverage Δ
src/selfhost/sentry.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.