feat(api): add GET /v1/repos/:owner/:repo/automation-state + CLI mirror

[galuis116]

Summary

• loopover_get_automation_state (an MCP tool in src/mcp/server.ts) had no REST or CLI-accessible mirror, unlike its write-side counterparts loopover_set_agent_paused / loopover_set_action_autonomy, which are reachable via PUT /settings and loopover-mcp maintain pause|resume|set-level.
• Extracted the tool's response-building logic into a shared buildAutomationStateResponse (new src/automation-state.ts) so the MCP tool and the new REST route can never drift on the data they return.
• Added GET /v1/repos/:owner/:repo/automation-state, gated with the same session/static-mcp repo-access check as the sibling issue-quality route (requireSessionRepoAccess + the coarse path-allowlist), and registered it in the CLI's stdio mirror as loopover_get_automation_state.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves.

Closes #6742

Validation

• git diff --check
• npm run actionlint (no workflow changes in this PR)
• npm run typecheck
• npm run test:coverage locally (targeted: the new/changed test files plus the existing mcp-automation-state.test.ts and mcp-tool-rename-aliases.test.ts all pass; mcp-cli-lint-pr-text.test.ts / mcp-cli-slop-risk.test.ts's pre-existing "non-regular file" symlink tests fail locally only because Windows requires elevated privileges to create symlinks -- unrelated to this diff and not exercised by it)
• npm run test:workers (not applicable to this change)
• npm run build:mcp (not applicable to this change)
• npm run test:mcp-pack (not applicable to this change)
• npm run ui:openapi:check (this route is not part of the curated public OpenAPI surface, same as its sibling maintainer-noise route; regeneration produced no diff)
• npm run ui:lint (no UI changes in this PR)
• npm run ui:typecheck (no UI changes in this PR)
• npm run ui:build (no UI changes in this PR)
• npm audit --audit-level=moderate (no dependency changes in this PR)
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• This PR only touches backend MCP/REST/CLI surfaces plus their tests (no UI, workers, MCP package build, or dependency changes), so the UI-scoped and package-build checks above have no surface to exercise. npm run docs:drift-check and npm run manifest:drift-check were also run locally and pass.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. The new REST route's tests cover: unauthenticated (401), a maintainer of a different repo (403 forbidden_repo), and a successful owner-session read.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A -- no UI changes in this PR.)
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots. (N/A -- this PR has no UI/visual surface; it adds a backend REST route + CLI/MCP mirror only.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• No UI Evidence table: this PR is backend-only (a REST route, a shared response builder, and a CLI/MCP stdio tool registration) with no visual surface to screenshot.
• Bumped the hardcoded tool-count pin in test/unit/mcp-tool-rename-aliases.test.ts from 75 to 76 to account for the newly registered loopover_get_automation_state CLI tool, following that file's existing per-PR pin-bump convention.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[JSONbored]

Merge conflicts:

This branch has conflicts that must be resolved
Use the [web editor](https://github.com/JSONbored/loopover/pull/6967/conflicts) or the command line to resolve conflicts before continuing.

src/mcp/server.ts
test/unit/mcp-tool-rename-aliases.test.ts