fix(review): freshness-gate shadow-override promotion, audit-before-write ordering, and clear_at preservation

[JSONbored]

Summary

Fixes 3 confirmed adversarial-audit findings in src/review/auto-apply.ts (plus a one-line, non-logic-changing export addition to src/review/auto-tune.ts so the new freshness gate can reuse the same RISK_MERGE_PRECISION threshold computeTuningRecommendations itself gates on, instead of duplicating the magic number):

• Shadow-override promotion never re-checks that the tightening is still warranted — a fully-recovered precision still gets permanently promoted
• Live override mutation is written before its audit record, and the audit write silently swallows errors — a config change can go live with zero audit trail
• INSERT OR REPLACE on tunables_overrides/tunables_overrides_shadow silently drops the clear_at column on every write, and the internal re-read that seeds the merge never passes nowIso so an expired override would never be treated as cleared

Each fix follows the audit's own verified failure scenario and root-cause analysis (2-independent-skeptic adversarial verification pass, both had to vote "confirmed").

Note: finding 1's fix threads a new optional mergePrecision field through AutoApplyContext into evaluateShadowPromotion, but the actual host-side cron wiring that populates AutoApplyContext from a GateEvalReport is explicitly deferred infra per this module's own header comment (not yet built) — same as the pre-existing decided/recs fields. The fix is fully correct and tested at the module boundary; when that wiring lands, it must pass the repo's current merge precision into ctx.mergePrecision.

Closes #6416
Closes #6420
Closes #6421

Test plan

• 12 new regression tests covering the freshness gate, audit-before-write ordering, and clear_at preservation
• test/unit/auto-apply.test.ts (95/95), test/unit/auto-tune.test.ts (55/55)
• Full local gate (npm run test:ci) green

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.59%. Comparing base (b09f262) to head (31814db).
⚠️ Report is 17 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6458   +/-   ##
=======================================
  Coverage   95.59%   95.59%           
=======================================
  Files         589      589           
  Lines       47025    47034    +9     
  Branches    14951    14956    +5     
=======================================
+ Hits        44952    44962   +10     
  Misses       1291     1291           
+ Partials      782      781    -1     

Flag	Coverage Δ
shard-1	44.08% <100.00%> (-0.17%)	⬇️
shard-2	37.02% <3.57%> (+0.38%)	⬆️
shard-3	32.33% <57.14%> (-0.04%)	⬇️
shard-4	34.46% <17.85%> (-0.84%)	⬇️
shard-5	31.43% <3.57%> (+0.41%)	⬆️
shard-6	45.70% <42.85%> (+0.27%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/review/auto-apply.ts	99.16% <100.00%> (+0.96%)	⬆️
src/review/auto-tune.ts	100.00% <100.00%> (ø)