refactor(github): consolidate githubHeaders cluster and CI-cache params (#4610)

[JSONbored]

Summary

• Finding 1 — extracts one shared githubHeaders REST-header builder into src/github/client.ts and replaces four independently-drifted local copies (each with a different signature) in src/github/app.ts, src/scoring/model.ts, src/services/contributor-issue-draft.ts, and src/upstream/ruleset.ts (14 call sites total). The new options-object signature ({ token?, accept?, json?, apiVersion? }) reconciles the four original shapes while producing byte-identical headers at every existing call site.
• Finding 2 — converts processors.ts's live CI-aggregate cache cluster (cachedFetchLiveCiAggregate, fetchLiveCiAggregateWithRequiredContexts, cachedLiveCiAggregate, refreshLiveCiAggregate) from 9-10 positional params — including three consecutive same-shaped optional strings (headSha, baseRef, token) with no compiler protection against transposition — to the single labeled options-object convention already used by neighboring large functions in this file. The 3-layer cache architecture (cachedLiveCiAggregate → refreshLiveCiAggregate → reuseOrRefreshLiveCiAggregate) is unchanged; only the parameter-passing convention changes.
• Both parts are mechanical, no-behavior-change refactors bundled together per the parent issue. Out of scope and untouched: the sibling review-enrichment/ githubHeaders cluster (Consolidate review-enrichment's 17-file githubHeaders() duplication #4609, already merged separately as a self-contained change).

Fixes #4610.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage (ran scoped vitest --coverage instead — see note below)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• This is a backend-only refactor (src/queue, src/github, src/scoring, src/services, src/upstream) with zero UI/MCP/workers-pool/OpenAPI/dependency surface, so those checks don't apply to this diff; CI runs them regardless. Locally: npm run typecheck is clean, and every changed file was verified with a targeted vitest --coverage pass (test/unit/github-client.test.ts — including 5 new tests exercising every branch of the new shared githubHeaders helper — plus test/unit/github-app.test.ts, test/unit/scoring.test.ts, test/unit/contributor-issue-draft.test.ts, test/unit/routes-contributor-issue-draft.test.ts, test/unit/upstream-ruleset.test.ts, and the full test/unit/queue.test.ts, 1124 tests total, all passing unmodified). Coverage was cross-checked line-by-line against the exact diff hunks: zero uncovered statements or branches on any changed line in either finding. The queue.test.ts suite needed no changes at all, confirming the CI-cache signature change is behavior-preserving.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (No auth behavior changed — only header construction — and the existing negative-path tests in github-app.test.ts, e.g. JWT-rejection/eviction and installation-token-rejection cases, pass unmodified against the refactored call sites.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (None changed.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (No UI changes.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Not applicable — backend-only refactor, no UI/frontend/visible changes.

Notes

• Rebased onto latest main immediately before pushing (git fetch origin && git rebase origin/main); the only concurrent processors.ts change on main (feat(review): instrument impact-map + add a public AI-reuse-rate trend (#4448) #4671, a 1-line edit ~6,000 lines away from this diff) rebased with no conflict.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.14%. Comparing base (e984eef) to head (c8c069c).
⚠️ Report is 5 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4681   +/-   ##
=======================================
  Coverage   94.14%   94.14%           
=======================================
  Files         435      435           
  Lines       38566    38567    +1     
  Branches    14060    14062    +2     
=======================================
+ Hits        36308    36309    +1     
  Misses       1599     1599           
  Partials      659      659           

Files with missing lines	Coverage Δ
src/github/app.ts	97.87% <ø> (-0.01%)	⬇️
src/github/client.ts	100.00% <100.00%> (ø)
src/queue/processors.ts	95.29% <100.00%> (+<0.01%)	⬆️
src/scoring/model.ts	97.05% <100.00%> (-0.09%)	⬇️
src/services/contributor-issue-draft.ts	97.46% <ø> (-0.02%)	⬇️
src/upstream/ruleset.ts	98.11% <100.00%> (-0.01%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.