fix(review): gate self-host visual-vision behind author opt-in

[JSONbored]

Motivation

• A recent change allowed the self-host AI_VISION path to run without the existing author/spend gate, enabling unconfirmed external contributors to trigger local vision model work and consume operator resources.
• The intent is to preserve the operator-protected AI-spend semantics used elsewhere: run for confirmed contributors by default, or for all authors only when a repository explicitly opts in (aiReviewAllAuthors).

Description

• Require the same author opt-in for self-host vision by introducing selfHostVisionAllowed = args.confirmedContributor || args.settings.aiReviewAllAuthors and computing selfHostVisionAvailable = selfHostVisionAllowed && Boolean(env.AI_VISION) in src/queue/processors.ts so the gate cannot be satisfied solely by env.AI_VISION.
• Pass the guarded selfHostVisionAvailable into the existing evaluateVisualVisionGate call so the visual-vision gate only permits execution when the author/repo opt-in is satisfied.
• Add regression tests in test/unit/visual-vision-wiring.test.ts that assert an unconfirmed contributor cannot trigger screenshot fetches or env.AI_VISION.run unless aiReviewAllAuthors is enabled, and that aiReviewAllAuthors still allows the explicit opt-in path.

Testing

• Ran the focused unit suites with npx vitest run test/unit/visual-vision-wiring.test.ts test/unit/visual-findings.test.ts --reporter=verbose, and all tests in those files passed (48 tests across the two files).
• Type-check succeeded (npm run typecheck).
• npm audit --audit-level=moderate could not complete due to a registry 403 Forbidden response (not related to the change).
• Attempting the full local gate via npm run test:ci did not complete because cf-typegen:check reported a stale worker-configuration.d.ts requiring regeneration; this drift is unrelated to the visual-vision logic and blocks completing the entire gate in this environment.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.95%. Comparing base (084cb38) to head (d540f90).
⚠️ Report is 14 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4393   +/-   ##
=======================================
  Coverage   93.95%   93.95%           
=======================================
  Files         400      400           
  Lines       36820    36821    +1     
  Branches    13452    13454    +2     
=======================================
+ Hits        34595    34596    +1     
  Misses       1569     1569           
  Partials      656      656           

Files with missing lines	Coverage Δ
src/queue/processors.ts	95.39% <100.00%> (+<0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.