fix(agent-actions): apply account-age throttle on issue contributor-cap path

[RealDiligent]

Summary

Completes the issue-path half of account-age throttle (#2561). Supersedes closed #3374, #3388, #3405, #3423, #3445.

Fix

• Wire accountAgeThresholdDays into issue contributor-cap path and label newly opened issues
• Extract shared helpers to src/queue/account-age-throttle.ts with dedicated unit tests (codecov/patch)
• Integration tests: tighten cap, established account, off-by-default, non-auto label, fail-open, custom label, owner/admin/bot exemption

Test plan

• npm run typecheck
• npm run selfhost:env-reference:check
• test/unit/account-age-throttle.test.ts (100% line coverage locally)
• 9 issue-path + 14 PR-path account-age queue tests pass locally

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-05 07:45:30 UTC}

5 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This wires the account-age threshold into the issue contributor-cap path and adds issue-open labeling parity with the PR path, with coverage for off/default behavior, exemptions, custom labels, and fail-open lookup behavior. The core behavior is correct in the visible diff: the issue cap is tightened only after the existing owner/admin/automation exemptions, the default-off path avoids the user lookup, and the configured label path is exercised. The main remaining concern is avoidable duplicate GitHub user lookups on newly opened issues where both labeling and cap enforcement run.

Nits — 5 non-blocking

• nit: src/queue/processors.ts:5627 and src/queue/processors.ts:4832 can call isBelowAccountAgeThreshold twice for the same opened issue, which adds an avoidable second GitHub user lookup on the hot webhook path.
• nit: src/queue/account-age-throttle.ts:13 would read better with a named milliseconds-per-day constant instead of repeating 24 * 60 * 60 * 1000 inline.
• nit: test/unit/queue.test.ts:10501 hardcodes the stubbed /users/ response login as "newbie", so established-account tests rely only on created_at and do not make the fixture match the requested author.
• src/queue/processors.ts:5627: compute the account-age result once for opened issues and pass it into maybeCloseIssueOverContributorCap, or add a tiny per-handler cache keyed by author login to avoid duplicate /users calls.
• src/queue/account-age-throttle.ts:13: extract `const MS_PER_DAY = 24 * 60 * 60 * 1000;` and use it in the age calculation.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#3374
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 132 registered-repo PR(s), 17 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	RealDiligent; Gittensor profile; 132 PR(s), 0 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: RealDiligent
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 132 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Await review-lane availability.
• Refresh registry data or choose a registered active repo.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.00%. Comparing base (be744ba) to head (ede98fe).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3455   +/-   ##
=======================================
  Coverage   92.99%   93.00%           
=======================================
  Files         296      297    +1     
  Lines       30972    30998   +26     
  Branches    11294    11303    +9     
=======================================
+ Hits        28803    28829   +26     
  Misses       1514     1514           
  Partials      655      655           

Files with missing lines	Coverage Δ
src/queue/account-age-throttle.ts	100.00% <100.00%> (ø)
src/queue/processors.ts	93.09% <100.00%> (+0.04%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.