fix(agent): make the fleet-wide DB freeze absolute, drop the per-repo bypass

[JSONbored]

Summary

• global_agent_controls.frozen (the fleet-wide DB kill-switch) had a per-repo escape hatch, repository_settings.agent_global_freeze_override / .loopover.yml's settings.agentGlobalFreezeOverride (operator-only, source: "api_record"), that let one repo opt out of the freeze while every other repo stayed frozen.
• That mechanism required either a raw DB write or an operator-only config field with no config-as-code parity with any other repo setting, and made "is this repo frozen" depend on two independently mutable sources of truth (a DB row that has to exist and stay in sync with a container-private config file) instead of one.
• This PR removes agentGlobalFreezeOverride entirely. global_agent_controls.frozen is now an absolute brake, the same tier as the AGENT_ACTIONS_PAUSED env var — no per-repo setting can bypass it anymore. Day-to-day per-repo enable/disable is settings.agentPaused, which is already resolved through the normal global-default + per-repo-override .loopover.yml config layering with zero DB coupling.
• Includes a small, unrelated doc-drift fix (separate commit): .loopover.yml.example still said "gittensory" in several prose comments after the repo rename while config/examples/loopover.full.yml already said "loopover" — fixed to unblock the local gate.

What changed

• Dropped repository_settings.agent_global_freeze_override (migration 0150), the Drizzle column, the FocusManifestSettings field and its source-gated parser branch in packages/loopover-engine/src/focus-manifest.ts, the OpenAPI field, and the now-unnecessary stripMaintainerFocusManifestSettings maintainer-write guard (nothing left to strip).
• Replaced every isDbFrozenForRepo(env, settings.agentGlobalFreezeOverride) call site with isGlobalAgentFrozen(env) directly (mcp/server.ts, github/client.ts, queue/review-evasion.ts, queue/processors.ts ×15, services/contributor-issue-draft.ts, services/agent-action-executor.ts ×2) — isDbFrozenForRepo itself is deleted.
• Updated/removed the tests that exercised the removed bypass; added regression coverage confirming the freeze is now unconditional and that AGENT_ACTIONS_PAUSED still wins independently.

Context

This was the root cause of a live incident: reviews stopped running on JSONbored/loopover after the gittensory→loopover repo rename. The fleet-wide DB freeze (set 2026-07-09 for an unrelated scope-leak incident) was still on, and the per-repo override wasn't taking effect for the renamed repo in production despite matching in every static/isolated test. The freeze has already been cleared directly (global_agent_controls.frozen = 0) to unblock production immediately; this PR is the follow-up architectural fix so the DB row can never again be the sole thing standing between "frozen" and "not frozen" for a repo.

Test plan

• npm run typecheck
• npm run test:coverage (unsharded)
• npm run test:ci (full local gate, green)
• npm audit --audit-level=moderate — 0 vulnerabilities
• npm run ui:openapi regenerated and committed
• npm run db:migrations:check / db:schema-drift:check — green
• npm run docs:drift-check / manifest:drift-check / engine-parity:drift-check — green
• Verified against live production data: JSONbored/loopover PRs are receiving reviews again post-unfreeze (docs(core): rename gittensory prose to loopover in remaining src subdirs #5895–docs(engine): rename gittensory prose to loopover in packages/loopover-engine (batch A) #5897 now show labels + comments)

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.