fix(review): log a bounded response snippet on unparseable AI output

[JSONbored]

Summary

• ai_review_provider_unparseable_exhausted (GITTENSORY-Z) has been firing since 2026-07-01 (83+ occurrences, still ongoing after confirming this isn't downstream of the P0 claude-code timeout outage — it kept firing hours into the post-fix clean-boot window). The logged fields (model, attempt, responseChars, hasJsonObject) give no way to tell WHY the model's output didn't parse — markdown-fenced JSON, a mid-object truncation, a plain-prose refusal, etc. Sentry's own Seer analysis on this issue independently suggested the same fix: log a truncated response prefix.
• Added a 400-char bounded snippet (UNPARSEABLE_RESPONSE_SNIPPET_MAX_CHARS) to runWorkersOpinion's per-attempt console.warn and exhaustion console.log in src/services/ai-review.ts, so the next occurrence carries enough content to actually diagnose.
• Safety constraint found and respected: my first attempt added the snippet to the AiReviewDiagnostic array (reviewDiagnostics) too, which broke an existing test ("single + BYOK: withholds unsafe provider and reviewer fallback text") — that array flows into result/public Sentry context, which must never carry raw provider text. The snippet now reaches ONLY the direct structured-log path (→ Sentry, internal-only), never reviewDiagnostics/result.

Closes #5071

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (Closes #5071).

Validation

• git diff --check
• npm run typecheck
• npm run test:coverage — this is a pure additive logging change (no new branches beyond what existing tests already cover); ran the affected file directly plus the repo's test:changed selection (3693 tests) and the full unsharded gate earlier in this session on a sibling branch off the same main — all green.
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries — added a truncation test and a public/private-boundary regression test (reviewDiagnostics never carries responseSnippet) alongside the existing unparseable-exhaustion test.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth surface touched.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A.)
• UI changes use live API data or real empty/error/loading states. (N/A — no UI changed.)
• Visible UI changes include a UI Evidence section. (N/A — backend-only.)
• Public docs/changelogs are updated where needed. (N/A.)

Notes

The snippet is a model's OWN response text (never PR diff/repo content), truncated to 400 chars, and reaches only Sentry (internal, operator-only) — never a public surface.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.14%. Comparing base (2205cde) to head (0f064de).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5073   +/-   ##
=======================================
  Coverage   94.13%   94.14%           
=======================================
  Files         466      466           
  Lines       39573    39576    +3     
  Branches    14436    14436           
=======================================
+ Hits        37254    37257    +3     
  Misses       1664     1664           
  Partials      655      655           

Flag	Coverage Δ
shard-1	46.50% <83.33%> (-0.02%)	⬇️
shard-2	33.44% <16.66%> (-0.12%)	⬇️
shard-3	31.60% <16.66%> (+0.25%)	⬆️
shard-4	32.70% <83.33%> (+0.01%)	⬆️
shard-5	33.19% <100.00%> (-0.24%)	⬇️
shard-6	45.14% <16.66%> (+0.19%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/services/ai-review.ts	96.74% <100.00%> (+0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.