fix(review): repair stale gate-check publication state

src/db/repositories.ts

@@ -3334,6 +3334,7 @@ export async function getCachedAiReview(
   pullNumber: number,
   headSha: string | null | undefined,
   mode: string,
+  expectedInputFingerprint?: string | undefined,
 ): Promise<{ notes: string; reviewerCount: number; findings: AdvisoryFinding[]; metadata?: Record<string, unknown> | undefined } | null> {
   if (!headSha) return null;
   const row = await env.DB
@@ -3342,6 +3343,11 @@ export async function getCachedAiReview(
     .first<{ notes: string; reviewerCount: number; mode: string; findingsJson: string | null; metadataJson: string | null }>();
   if (!row || row.mode !== mode) return null;
   const metadata = parseJson<Record<string, unknown>>(row.metadataJson, {});
+  if (
+    expectedInputFingerprint !== undefined &&
+    metadata.inputFingerprint !== expectedInputFingerprint
+  )
+    return null;
   return {
     notes: row.notes,
     reviewerCount: row.reviewerCount,

src/env.d.ts

@@ -210,6 +210,7 @@ declare global {
     REES_SHARED_SECRET?: string;
     REES_TIMEOUT_MS?: string;
     REES_ANALYZERS?: string;
+    REES_PROFILE?: string;
     REES_FORWARD_GITHUB_TOKEN?: string;
     /** Convergence flag: the deterministic content/registry SURFACE LANE drives the gate for registry-submission
      *  PRs (metagraphed surfaces[]/providers/candidates). Truthy ON *AND* the repo in GITTENSORY_REVIEW_REPOS —