feat(review): wire the deterministic surface lane into the gate (flag-gated)

[JSONbored]

Summary

Wires the content/registry surface lane (runSurfaceReview — a pure, AI-free, structured-data adjudicator for metagraphed registry-submission PRs) into the gate, behind GITTENSORY_REVIEW_CONTENT_LANE (default OFF) + the per-repo GITTENSORY_REVIEW_REPOS allowlist. When off, the processor takes no new branch, resolves no files, and the gate disposition is byte-identical. The verdict never depends on an AI model, so this is independent of the AI-reviewer accuracy work (the lane emits none of the AI_JUDGMENT_BLOCKER_CODES).

New src/review/content-lane-wire.ts maps the deterministic verdict → gate disposition (merge→success, close→failure with a critical surface_lane_reject blocker, manual→action_required) and overrides the generic gate for a registry submission, with two safety guards:

• applySurfaceGate preserves the generic gate's hard blockers — a surface "merge" can never clear a real critical (e.g. a committed secret) the generic gate already raised.
• A fetch blip defers instead of auto-closing — an unreadable head, or a null base on a file GitHub marks "modified" (whose base must exist, so null is transient — distinguished from an added file's expected absent base via the PR file status), routes to the generic gate rather than one-shot-closing a valid append.

The close code is deliberately not an AI-judgment code, so green-CI refutation can never flip a deterministic surface close. The processor seam is a single call; the nullable-ref + override logic lives in the unit-tested helper.

Validation

• npm run test:ci green; cf-typegen regenerated.
• 19 unit tests incl. the two adversarial-found regressions (modified-file transient-base-null defers; added-file null-base still merges) + the blocker-preservation safety test; 100% branch coverage on the adapter and the processor seam (266 existing processor tests).
• Adversarially verified (3 lenses: false-close / unsafe-merge / flag-off regression) — the one HIGH finding (base-fetch false-close) is fixed in this PR.

Safety

• Default OFF → byte-identical deploy; AI-free, independent of the AI-accuracy work.

Advances #1255.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 97.56098% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 95.26%. Comparing base (65da585) to head (8b95af4).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/review/content-lane-wire.ts	97.50%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1340   +/-   ##
=======================================
  Coverage   95.26%   95.26%           
=======================================
  Files         186      187    +1     
  Lines       20318    20359   +41     
  Branches     7324     7339   +15     
=======================================
+ Hits        19355    19395   +40     
  Misses        378      378           
- Partials      585      586    +1     

Files with missing lines	Coverage Δ
src/queue/processors.ts	87.55% <100.00%> (+0.01%)	⬆️
src/review/content-lane-wire.ts	97.50% <97.50%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.