fix(review): stop the medium-effort retry storm burning tokens on zero output

[JSONbored]

Summary

• Production audit (live Loki/Prometheus on edge-us-01) found reviews burning tokens for zero usable output in a self-sustaining loop: EFFORT_TIMEOUT_MS gives medium (the default reasoning effort) the same 120s CLI timeout as low, so a real medium-effort review on a non-trivial diff can get SIGKILLed mid-generation. That PR's head SHA never gets a completed gate check, which surfaceRepairPriorityPullNumbers (queue/processors.ts) reads as an outage and deliberately bypasses the sweep's staleness throttle to repair fast -- but it has no memory of prior attempts, so a PR whose repair keeps failing the same way gets re-swept and re-billed on every ~2-minute sweep tick, forever.
• Fix has two parts: (1) give medium its own 180s timeout tier instead of sharing low's; (2) cap the outage-repair bypass at 3 attempts per exact head SHA (via the existing audit_events ledger, no new table/migration), after which the PR falls back to ordinary staleness-gated candidacy and one exhausted-audit-event is recorded instead of retrying silently forever.
• Confirmed live in production: 13 subscription_cli_timeout failures across 8 PRs in one 47-minute window, with the same PR (feat(enrichment): empty-catch / error-swallow analyzer #3532) re-dispatched by two separate repair jobs 6 minutes apart, each burning its own 3x120s retry loop.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• No issue linked -- this was discovered via a live production audit (not a filed issue), and the summary above explains the root cause and evidence directly.

Validation

• git diff --check
• npm run actionlint -- not run (no workflow files touched)
• npm run typecheck -- clean
• npm run test:coverage (full/unsharded) -- not run locally; ran the two affected files directly instead (test/unit/selfhost-ai.test.ts 126/126 passed, test/unit/queue.test.ts 586/586 passed incl. 2 new regression tests) plus a scoped --coverage pass confirming the new branches are exercised (the two structurally-unreachable defensive guards are v8 ignored with an inline rationale, matching existing house convention for the same pattern elsewhere in this file). Trusting CI for the full unsharded gate given this is a live-incident fix.
• npm run test:workers / npm run build:mcp / npm run test:mcp-pack / npm run ui:openapi:check / npm run ui:lint / npm run ui:typecheck / npm run ui:build / npm audit --audit-level=moderate -- not run locally (no wrangler/MCP/UI/dependency surface touched by this diff); left to CI.
• New/changed behavior has regression tests: two new tests in queue.test.ts cover (a) the attempt cap kicking in and demoting a stuck SHA back to ordinary cadence with exactly one exhausted-audit-event, and (b) an under-cap dispatch recording an attempt, plus no duplicate exhausted-event across repeated ticks once already flagged.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• N/A -- no auth/cookie/CORS/GitHub App/Cloudflare/session changes.
• N/A -- no API/OpenAPI/MCP surface changed.
• N/A -- no UI changes.
• N/A -- no docs/changelog changes needed.

Notes

• A CLAUDE_AI_TIMEOUT_MS=240000 env override and a temporary CRON_INTERVAL_MS=900000 sweep-cadence brake are already live on the VPS as stop-gap mitigations while this PR lands; both should be reverted once this ships (the code fix makes them unnecessary, and the cadence brake in particular trades off sweep/auto-merge responsiveness that should be restored).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.30%. Comparing base (d0a5793) to head (8ae4daf).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3747   +/-   ##
=======================================
  Coverage   93.29%   93.30%           
=======================================
  Files         317      317           
  Lines       32347    32363   +16     
  Branches    11871    11873    +2     
=======================================
+ Hits        30179    30195   +16     
  Misses       1537     1537           
  Partials      631      631           

Files with missing lines	Coverage Δ
src/queue/processors.ts	94.10% <100.00%> (+0.03%)	⬆️
src/selfhost/ai.ts	98.59% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.