fix(agent): the raw-fetch GitHub writers respect the global pause / freeze

[JSONbored]

Summary

The dry-run client chokepoint (#1258) suppresses installation-Octokit writes under a non-live mode, but two agent-initiated writers use a raw PAT outside it and ignored the operator brake — the documented boundary from that PR:

• fileUpstreamDriftIssues (upstream/ruleset.ts) POSTed/PATCHed GitHub issues every cron tick, gated only by GITTENSORY_AUTO_FILE_DRIFT_ISSUES — neither the env brake nor the DB freeze stopped it (a globally-paused/frozen agent still filed issues).
• generateContributorIssueDrafts (services/contributor-issue-draft.ts) filed issues whenever a caller passed {dryRun:false}, with no relation to the agent action mode.

Fix

Both now consult the global agent state:

• fileUpstreamDriftIssues returns early with status: "paused" under the env brake or DB freeze.
• The contributor-draft dryRun flag is OR-ed with isGlobalAgentPause(env) || isGlobalAgentFrozen(env), so a paused/frozen agent never writes even when a caller asks to create.

The end-user fork drafting (services/draft.ts) is intentionally left alone — it acts under the user's own OAuth token, a different actor class than the autonomous agent, so the agent's operator brake should not silence it.

This closes the raw-fetch boundary so the "no autonomous GitHub write under pause/freeze" invariant now holds for all agent-initiated writers, not just the installation-Octokit ones.

Scope

• Backend only (upstream/ruleset.ts, services/contributor-issue-draft.ts); no schema / migration / binding change

Validation

• npm run test:ci — full gate green
• npm audit --audit-level=moderate — 0 vulnerabilities
• Regression tests for each writer cover both the env-brake and DB-freeze arms, asserting no POST/PATCH reaches the network
• Every changed line + branch covered
• Rebased onto latest main immediately before opening

Safety

• No secrets / wallets / hotkeys / trust scores / reward values; the change only ever removes a GitHub write under pause/freeze
• No site/ / CNAME / lovable

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.03%. Comparing base (449de19) to head (7a17c76).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1263   +/-   ##
=======================================
  Coverage   95.03%   95.03%           
=======================================
  Files         177      177           
  Lines       19884    19886    +2     
  Branches     7164     7166    +2     
=======================================
+ Hits        18896    18898    +2     
  Misses        395      395           
  Partials      593      593           

Files with missing lines	Coverage Δ
src/services/contributor-issue-draft.ts	97.48% <100.00%> (ø)
src/upstream/ruleset.ts	98.49% <100.00%> (+<0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.