feat(review): add a security-focused review profile toggle

[JSONbored]

Summary

• review.profile (src/signals/focus-manifest.ts) only ever tuned HOW MANY findings the AI reviewer surfaces (chill suppresses nits, assertive raises them) — there was no way to tell the reviewer WHAT KIND of defect to prioritize. Adds a new, orthogonal review.security_focus: boolean toggle (mirroring the existing review.inline_comments boolean pattern rather than extending the chill/balanced/assertive union, since this is a "what to hunt for" axis, not a fourth volume level).
• Parses review.security_focus in parseReviewConfig, adds it to FocusManifestReviewConfig, reviewConfigToJson (cache round-trip), and resolveReviewPromptOverrides — the same manifest-only sites review.profile and review.inline_comments already flow through (no DB column / OpenAPI field needed, confirmed via npm run ui:openapi:settings-parity — review.profile itself isn't in RepositorySettingsSchema either, it's a .gittensory.yml-only field).
• Wires it through src/services/ai-review.ts: a new SECURITY_FOCUS_SUFFIX constant appended in buildSystemPrompt right after the existing REVIEW_PROFILE_SUFFIX, naming injection, authn/authz bypass, secret handling, unsafe deserialization, SSRF, and path traversal as elevated-scrutiny categories. It composes with (never replaces) the profile suffix.
• Threads securityFocus through src/queue/processors.ts (resolveReviewPromptOverrides destructure → runAiReviewForAdvisory args → runGittensoryAiReview call) and adds it to src/review/ai-review-cache-input.ts's fingerprint payload so flipping the toggle invalidates the AI-review cache instead of replaying a stale review.
• Off/unset by default at every layer, so an existing repo's reviewer prompt is byte-identical.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint (via npm run test:ci)
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

All run via the full local gate: npm run test:ci (actionlint, migrations check, cf-typegen check, typecheck, unsharded test:coverage, test:workers, build:mcp, test:mcp-pack, build:miner, rees:test, ui:openapi:check, ui:openapi:settings-parity, ui:version-audit, ui:lint, ui:typecheck, ui:test, ui:build) — all green, 6740+ tests passing — plus npm audit --audit-level=moderate reporting 0 vulnerabilities. Added/updated tests: test/unit/focus-manifest.test.ts (parsing, round-trip, resolveReviewPromptOverrides composition), test/unit/ai-review.test.ts (system-prompt composition with and without profile), test/unit/ai-review-cache-input.test.ts (fingerprint changes when the toggle flips, independent of profile), plus fixture updates in test/unit/ai-review-cache.test.ts, test/unit/queue.test.ts, and test/unit/signals-coverage.test.ts for the new required field.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

No auth/cookie/CORS/session/UI/docs changes in this PR — it's a backend prompt-composition + manifest-parsing change only, so those boxes don't apply.

UI Evidence

Not applicable — no UI/frontend/docs changes in this PR.

Notes

• Left the actual review.security_focus field out of RepositorySettingsSchema/OpenAPI intentionally: review.profile, review.inline_comments, and review.path_instructions are all manifest-only (.gittensory.yml-only) fields with no DB column, confirmed unaffected by npm run ui:openapi:settings-parity (still reports the same 62 fields) — security_focus follows that exact precedent rather than the full DB+OpenAPI config-as-code checklist, which applies to RepositorySettings-backed fields.

Closes #2566

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.10%. Comparing base (642b12d) to head (38a7f78).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2675   +/-   ##
=======================================
  Coverage   96.10%   96.10%           
=======================================
  Files         237      237           
  Lines       26538    26542    +4     
  Branches     9624     9626    +2     
=======================================
+ Hits        25505    25509    +4     
  Misses        424      424           
  Partials      609      609           

Files with missing lines	Coverage Δ
src/queue/processors.ts	92.57% <ø> (ø)
src/review/ai-review-cache-input.ts	100.00% <ø> (ø)
src/services/ai-review.ts	95.27% <100.00%> (+0.02%)	⬆️
src/signals/focus-manifest.ts	99.29% <100.00%> (+<0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.