fix(settings): PROTECTED_AUTOCLOSE_AUTHORS_EXTRA uses a narrower list-parsing convention than the unified GitHub-login-list parser (#audit-3.13)

[JSONbored]

Context

src/settings/agent-actions.ts:77-83 parses the PROTECTED_AUTOCLOSE_AUTHORS_EXTRA env var with .split(",") only. src/auth/security.ts:139-146's parseGitHubLoginList — used for ADMIN_GITHUB_LOGINS everywhere else in the codebase, e.g. src/queue/review-evasion.ts:366 — explicitly splits on /[\s,]+/ "so every caller agrees on the same parse (#audit-3.13)." A self-hoster setting PROTECTED_AUTOCLOSE_AUTHORS_EXTRA with newline- or space-separated logins (a reasonable assumption given the sibling env var's convention) gets them silently concatenated into one unmatched string instead of correctly split. This env var appears to have been missed by the #audit-3.13 unification pass.

Requirements

• Update agent-actions.ts:77-83 to use parseGitHubLoginList (src/auth/security.ts:139-146) instead of its own bare .split(","), matching every other env-var-derived login list in this codebase.
• Do not change parseGitHubLoginList itself.

Test Coverage Requirements

99%+ Codecov patch coverage on the changed parsing call; add a regression test setting PROTECTED_AUTOCLOSE_AUTHORS_EXTRA with mixed space/newline/comma separators and confirming it parses into the correct individual logins, matching ADMIN_GITHUB_LOGINS's existing equivalent test.

Deliverables

• PROTECTED_AUTOCLOSE_AUTHORS_EXTRA parses via parseGitHubLoginList.
• Regression test for mixed-separator input.

Expected Outcome

PROTECTED_AUTOCLOSE_AUTHORS_EXTRA parses consistently with every other GitHub-login-list env var in this codebase, instead of being the one outlier a self-hoster could misconfigure.

Links & Resources

• src/settings/agent-actions.ts:77-83
• src/auth/security.ts:139-146 (parseGitHubLoginList, #audit-3.13)
• src/queue/review-evasion.ts:366 (correct existing usage)

[linear-code]

JSO-4302