test(review): lock advisory live disposition parity

[joaovictor91123]

Summary

• Closes test(review): regression test locking advisory==live verdict/disposition parity #2190 by adding a regression test that pins advisory/live terminal disposition parity for one passing and one failing PR fixture.
• The test asserts the same computed verdict/disposition/confidence signature while only live autonomy reaches the merge/close execution spy; advisory/observe autonomy plans no terminal action.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires >=99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• npx vitest run test/unit/agent-actions.test.ts passed locally.
• npm run test:ci was attempted on Windows. It passed setup checks through cf-typegen:check and typecheck, then failed in unrelated Unix-shell self-host script fixtures that do not execute correctly in this Windows shell.
• npx vitest run --coverage test/unit/agent-actions.test.ts passed the focused suite but fails the repo-wide global coverage threshold because only one file was selected.

Safety

• No secrets, user PATs, private keys, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized and low-noise.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session behavior is not changed.
• API/OpenAPI/MCP behavior is not changed.
• UI behavior is not changed.
• No visible UI changes; UI evidence is not applicable.
• Public docs/changelogs are not changed.

UI Evidence

Not applicable; test-only PR.

Notes

• Test-only change in test/unit/agent-actions.test.ts.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 Gittensory is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.34%. Comparing base (bdc5870) to head (ea5a7d4).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3685   +/-   ##
=======================================
  Coverage   93.34%   93.34%           
=======================================
  Files         315      315           
  Lines       32129    32129           
  Branches    11780    11780           
=======================================
  Hits        29991    29991           
  Misses       1507     1507           
  Partials      631      631           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Gittensory is closing this pull request on the maintainer's behalf (AI reviewers agree on a likely critical defect: test/unit/agent-actions.test.ts: `advisoryComputedSignature` is built from `terminalDisposition(livePlan)` / `terminalAction(livePlan)` instead of `advisoryPlan`, making the `expect(liveSignature).toEqual(advisoryComputedSignature)` assertion a self-comparison that always passes regardless of whether advisory and live actually agree — the PR's stated goal (parity lock) is not tested.). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.