fix(review): make manifest_missing_tests CI- and bot-aware

[JSONbored]

Summary

• manifest_missing_tests computed passedValidationCount from a pure PR-body regex match (hasValidationNote) with zero connection to the PR's real CI results. A confirmed false positive: JSONbored/awesome-claude PR feat(ui): slop-band calibration card on the analytics dashboard (#2196) #4719, a fully-automated github-actions[bot] README-regen PR, got a FAILURE conclusion even though its real CI was fully green, because the templated body never uses "tested"/"validated" wording, and that repo's manifestPolicy: block escalated it into a hard blocker.
• passedValidationCount now ALSO consults the PR's live CI state (cachedLiveCiAggregate, the same infra the disposition/unified-comment already use) — a fully-green CI rollup counts as evidence, in addition to the existing PR-body text match. ciState === "passed" already excludes gittensory's own Gate/Context check-runs, so this can never be self-referential.
• Added a bot-author exemption to the manifestPolicyGateMode block, mirroring the existing review.auto_review.ignore_authors glob (reusing the eligibility check already computed for the AI-review skip) — a fully-automated bot PR is no longer held to "did you demonstrate test evidence" scrutiny meant for human contributors.

Closes #4401

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint (unaffected by this diff — no workflow files touched; covered by npm run test:ci)
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers (unaffected by this diff; covered by npm run test:ci)
• npm run build:mcp
• npm run test:mcp-pack (unaffected by this diff; covered by npm run test:ci)
• npm run ui:openapi:check (no API/schema changes)
• npm run ui:lint (no UI changes)
• npm run ui:typecheck (no UI changes)
• npm run ui:build (no UI changes)
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Ran the full npm run test:ci gate locally; all UI/MCP/workers/schema checks above pass unaffected since this diff only touches src/queue/processors.ts and test/unit/queue.test.ts.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/session changes)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — no API/schema changes)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — no UI changes)
• Visible UI changes include a UI Evidence section below. (N/A — backend-only change, no visible UI)
• Public docs/changelogs are updated where needed. (N/A — no user-facing docs/changelog affected; internal signal logic only)

UI Evidence

N/A — backend-only change (no UI, no visible surface).

Notes

• New helper resolveManifestPassedValidationCount in src/queue/processors.ts only fetches live CI when the manifest actually configured testExpectations, no test file changed, and no PR-body validation note was found — so repos that haven't opted into testExpectations pay zero extra GitHub calls (byte-identical to before).
• The bot-author exemption filters manifest_missing_tests out of guidance.findings itself (not just the advisory-push loop), so the existing E2E-test-generation auto-trigger (feat(review): auto-trigger E2E test generation on the manifest_missing_tests signal #4196) is exempted too, staying consistent with the same "don't scrutinize a bot PR for test evidence" decision.
• Tracking issue: fix(review): manifest_missing_tests ignores real CI status and has no bot exemption #4401.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 92.85714% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 93.96%. Comparing base (64fb1a3) to head (b6981c9).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/queue/processors.ts	92.85%	1 Missing ⚠️

❌ Your patch status has failed because the patch coverage (92.85%) is below the target coverage (99.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4406      +/-   ##
==========================================
- Coverage   93.96%   93.96%   -0.01%     
==========================================
  Files         401      401              
  Lines       36892    36902      +10     
  Branches    13490    13494       +4     
==========================================
+ Hits        34667    34676       +9     
- Misses       1569     1570       +1     
  Partials      656      656              

Files with missing lines	Coverage Δ
src/queue/processors.ts	95.37% <92.85%> (-0.02%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.