fix(signals): require a real shared file before path-driven PR collisions cluster

[JSONbored]

Summary

• Shadow-tested buildCollisionReport against the live open-PR queue for JSONbored/gittensory (16 real open PRs) after feat(signals): flag open-vs-open PR file-path collisions #2654 shipped open-PR file-collision detection flag-gated OFF. With changedFiles folded into the same bag-of-words scorer as titles/labels, 20 clusters were flagged vs. 3 without path terms — but 12 of the 17 new ones shared zero actual files, driven purely by generic directory-segment tokens (src, review, test, unit) that recur across nearly every PR in a consistently-organized repo.
• Fix: when a pair's match is driven by path terms alone (re-scoring without paths no longer clears the overlap bar), require an actual shared, non-lockfile/generated file path (reusing diffFilePriority from src/review/review-diff.ts) before letting it cluster. Mirrors the existing same-author guard's "re-score without paths" pattern.
• Re-validated against the same 16-PR dataset post-fix: 9 clusters remain, every one backed by a real shared file (e.g. two PRs both touching packages/gittensory-mcp/bin/gittensory-mcp.js — a genuine merge-conflict warning).
• Enables GITTENSORY_OPEN_PR_FILE_COLLISION now that the false-positive rate is resolved.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• Small, self-evident follow-up to already-merged Open PRs carry no file-path metadata, so the collision engine misses open-vs-open path overlap #2653/feat(signals): flag open-vs-open PR file-path collisions #2654 — no fresh issue needed; rationale is the shadow-test data above.

Validation

• git diff --check
• npm run actionlint (via npm run test:ci)
• npm run typecheck
• npm run test:coverage locally, unsharded (358 files, 6859 tests passed; engine.ts 99.36% stmts / 98.28% branch)
• npm run test:workers (via npm run test:ci)
• npm run build:mcp (via npm run test:ci)
• npm run test:mcp-pack (via npm run test:ci)
• npm run ui:openapi:check (via npm run test:ci)
• npm run ui:lint (via npm run test:ci)
• npm run ui:typecheck (via npm run test:ci)
• npm run ui:build (via npm run test:ci)
• npm audit --audit-level=moderate — 0 vulnerabilities
• New tests cover: different-author + real shared file (clusters), different-author + token-only overlap with zero real files (does not cluster), different-author + lockfile-only shared file (does not cluster), and a control proving a real shared file added back to the token-only pair clusters again

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/session surface touched)
• API/OpenAPI/MCP behavior is updated and tested where needed. (no OpenAPI/MCP surface changed)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — no UI changed)
• Visible UI changes include a UI Evidence section below. (N/A — no visible UI change)
• Public docs/changelogs are updated where needed. (N/A — no docs/changelog change)

Notes

• worker-configuration.d.ts regenerated via npm run cf-typegen to reflect the GITTENSORY_OPEN_PR_FILE_COLLISION literal-type flip to "true".

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 96.15%. Comparing base (a2ea220) to head (b3b7ba5).
⚠️ Report is 10 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/signals/engine.ts	66.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #2696    +/-   ##
========================================
  Coverage   96.15%   96.15%            
========================================
  Files         240      240            
  Lines       26867    26967   +100     
  Branches     9751     9789    +38     
========================================
+ Hits        25833    25930    +97     
- Misses        424      426     +2     
- Partials      610      611     +1     

Files with missing lines	Coverage Δ
src/signals/engine.ts	97.66% <66.66%> (-0.06%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.