fix(sync): isolate unauthenticated fallback rate limits

[JSONbored]

Motivation

• A scoped GITHUB_PUBLIC_TOKEN 404 retry triggers an unauthenticated REST fallback whose rate-limit headers (unauthenticated 60-request bucket) were being recorded into the shared REST observation table, which can cause later token-backed segments to wait erroneously.

Description

• Stop persisting unauthenticated fallback responses in githubJsonWithHeaders so fallback fetches still return data but their x-ratelimit-* headers are not recorded into the shared REST backoff state (src/github/backfill.ts).
• Add a regression test keeps successful unauthenticated fallback responses out of the shared REST backoff that simulates a public-token 404 followed by a successful unauthenticated response with unauthenticated rate-limit headers and then asserts a later token-backed segment proceeds (test/unit/backfill.test.ts).
• Changed files: src/github/backfill.ts and test/unit/backfill.test.ts.
• Preserves existing functionality of performing the unauthenticated retry while preventing shared limiter poisoning.

Testing

• Ran npm run typecheck (tsc --noEmit) which completed successfully.
• Ran the unit tests with npm run test:unit -- test/unit/backfill.test.ts and observed all unit tests pass (Test Files 93 passed, Tests 1344 passed).

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	b60f494	Commit Preview URL Branch Preview URL	Jun 10 2026, 07:08 AM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#499 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.