fix(review): stop the sweep from endlessly re-evaluating already-reviewed PRs

[JSONbored]

Summary

• Live incident, root-caused tonight: the primary GitHub rate limit (5000/hr) was fully exhausted twice in 2 hours. Confirmed cause: the re-gate sweep re-checks every open PR forever for silent drift (base moved, sibling merged, config changed) -- including PRs it already fully reviewed. A PR that structurally can never auto-close (owner-authored + failing CI, closeOwnerAuthors: false) sits in that rotation indefinitely. Confirmed live: 9 owner-authored PRs with failing checks (some 36+ hours old) were each getting a full PR + CI state re-fetch from GitHub every ~2-minute sweep tick, for hours.
• selectRegateCandidates (src/settings/agent-sweep.ts) now permanently excludes any PR the sweep has already regated even once -- no re-check-for-drift window, fail-closed. Re-review only happens through two channels, neither of which is this sweep: a genuine new push (new head SHA, real-time webhook path) or an explicit maintainer-triggered re-review (the PR panel's re-run checkbox, role-gated via commandAuthorizationAllowedRoles, never hardcoded to a specific login -- verified in src/queue/processors.ts's panel-retrigger handler).
• The existing repairPriority bypass is preserved unchanged: a PR whose prior review never actually landed (crashed/incomplete publish) still gets retried -- that delivers the one review it was owed, not a second one.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused (one file's logic change + its two test files).
• Follows CONTRIBUTING.md.
• Owner-authored incident-response fix, no linked issue.

Validation

• npm run typecheck
• npx vitest run test/unit/agent-sweep.test.ts (32/32 passing, all updated to assert the new one-shot semantics)
• npx vitest run test/unit/queue.test.ts -t "agent re-gate sweep processes strict staleness order" (the one integration test exercising this exact scenario, updated and passing)
• Full unsharded npm run test:coverage was NOT re-run locally before push given the live incident's urgency (queue actively growing, rate limit actively being consumed) -- relying on CI's full gate to catch anything the targeted runs above missed. Will monitor CI and fix forward if anything surfaces.

Safety

• No secrets, wallet, hotkey, trust-score, or reward data touched.
• No auth/CORS/session changes.
• No API/OpenAPI/MCP surface changed.
• No UI changes.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.02%. Comparing base (6020670) to head (4a86e8e).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4474   +/-   ##
=======================================
  Coverage   94.02%   94.02%           
=======================================
  Files         420      420           
  Lines       37479    37479           
  Branches    13692    13692           
=======================================
  Hits        35240    35240           
  Misses       1583     1583           
  Partials      656      656           

Files with missing lines	Coverage Δ
src/settings/agent-sweep.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.