fix(config): route repository-settings reads through the resolver, not the raw DB accessor

[JSONbored]

Summary

• backfillRegisteredRepositories, enqueueRepositoryOpenDataBackfill, buildInstallationRepairDiagnostics, refreshInstallationHealthRecords, and the MCP getAutomationState tool all read repository settings via the raw getRepositorySettings DB accessor instead of resolveRepositorySettings. A .gittensory.yml override for backfillEnabled / checkRunMode / gateCheckMode / reviewCheckMode / autonomy / agentPaused / agentDryRun was silently ignored at these five call sites, even though the actual gate/action-execution pipeline (agent-approval-queue.ts and friends) already resolves these correctly.
• Fixed by switching all five to resolveRepositorySettings.
• Three other call sites (loadPublicRepoBadge, buildRegistrationReadinessResponse + buildGittensorConfigRecommendationResponse, loadContributorIssueDraftContext) were investigated and found to be intentional, not bugs — each now has a comment explaining why:
  • loadPublicRepoBadge is an unauthenticated, high-frequency public route (a README-embedded badge image); it deliberately trades honoring a yml-only override for avoiding a manifest-cache lookup on every image load.
  • The two advisory/recommendation builders and the contributor-issue-draft context loader already load the raw DB settings and the raw (cache-only) .gittensory.yml manifest separately, because their entire purpose is to show the two config layers side-by-side for comparison/recommendation — merging them would defeat that purpose.

Resolves #2912. First of a series of follow-ups tracked under #1667 from a 2026-07-04 self-host review-engine audit.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• Linked issue: fix(config): route all repository-settings reads through the resolver, not the raw DB accessor #2912.

Validation

• git diff --check
• npm run typecheck
• Targeted vitest run on all affected test files (test/unit/backfill.test.ts, test/unit/mcp-automation-state.test.ts, test/unit/contributor-issue-draft.test.ts, test/unit/self-dogfood-registration-pack.test.ts, test/integration/api.test.ts) — 306 tests passed
• npm run test:changed (Vitest's real-import-graph diff selection against main) — 203 files / 5005 tests passed, 0 failed
• npm run actionlint / npm run test:workers / npm run build:mcp / npm run test:mcp-pack / npm audit / ui:* — not run locally; no workflow, worker-pool, MCP-package, or UI files touched. CI runs the full gate.
• New behavior (the resolver now being consulted) has regression tests for both sides: a .gittensory.yml-only override taking effect (3 new regression tests) alongside the pre-existing DB-only-override tests, which still pass unchanged.

If any required check was skipped, explain why:

• test:coverage/test:ci not run locally — this diff only swaps one function call per site (no new branches beyond the three regression tests, which are covered by the targeted run above) plus doc-only comments at the four intentional-exception sites. Per this repo's established practice, CI's full gate covers the rest.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no such changes; this is a settings-read source swap.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (The MCP getAutomationState tool's output can now change based on yml, and is covered by a new regression test. No schema shape changed.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — no UI changes.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (N/A — no changelog edit.)

Notes

• One test-isolation fix included: test/unit/mcp-automation-state.test.ts had no afterEach(() => vi.unstubAllGlobals()), so my new regression test's vi.stubGlobal("fetch", ...) leaked into two unrelated later tests in the same file. Added the missing cleanup hook (a no-op for every existing test, since none of them stub globals).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.05%. Comparing base (c3a990e) to head (a19e6e4).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2920   +/-   ##
=======================================
  Coverage   96.05%   96.05%           
=======================================
  Files         258      258           
  Lines       28423    28423           
  Branches    10341    10341           
=======================================
  Hits        27301    27301           
  Misses        489      489           
  Partials      633      633           

Files with missing lines	Coverage Δ
src/api/routes.ts	94.49% <ø> (ø)
src/github/backfill.ts	96.66% <100.00%> (ø)
src/mcp/server.ts	95.80% <ø> (ø)
src/services/contributor-issue-draft.ts	97.48% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 Gittensory is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}