fix(review): derive four hardcoded gittensory literals from their config (#4615)

[JSONbored]

Summary

• Four small, independent hardcoding cleanups from the review-stack architecture audit (Minor hardcoding cleanup batch #4615):
  1. isOwnReviewThreadAuthor (src/github/backfill.ts) now derives its own-bot match from env.GITHUB_APP_SLUG instead of a hardcoded gittensory regex — matching every other self-authorship check in the codebase (self-authored.ts, pr-actions.ts, comments.ts, processors.ts), so a self-hoster who renames their App still recognizes its own review-thread comments.
  2. isProtectedAutomationAuthor (src/settings/agent-actions.ts) gains an additive PROTECTED_AUTOCLOSE_AUTHORS_EXTRA env override so a self-hoster running a different automation stack (mergify[bot], snyk-bot, ...) can extend the built-in allowlist without forking the code.
  3. The Orb OAuth landing page's dashboard link (src/orb/oauth.ts) now follows env.PUBLIC_SITE_ORIGIN, falling back to the public gittensory dashboard — mirroring maintainerControlPanelUrl one file-family over (github/footer.ts). The Orb App's centrally-hosted key-broker design is unchanged; only this post-OAuth "open the dashboard" link becomes configurable.
  4. normalizeReturnTo's OAuth returnTo allowlist (src/auth/github-oauth.ts) drops the redundant hardcoded https://gittensory.aethereal.dev entry — siteOrigin already equals that value whenever PUBLIC_SITE_ORIGIN is unset, so the literal was only ever adding a bonus accepted origin for a self-hoster who had set their own.
• Item 5 (packages/gittensory-engine/src/signals/local-branch.ts, the gittensory_not_registered self-referential advisory finding) is deferred: the issue's cited path doesn't match current main — that code actually lives at src/signals/local-branch.ts and is not part of what's bundled into any published npm package today (the separately-maintained packages/gittensory-mcp/lib/local-branch.js is a different, smaller file with no such literal). The issue itself frames this item as the lowest-priority, no-config-path judgment call; given the path mismatch and no functional win from deduplicating the literal today, it's left as-is.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves.

Fixes #4615

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• Targeted vitest run --coverage on the four changed suites (test/unit/backfill.test.ts, test/unit/agent-actions.test.ts, test/unit/auth.test.ts, test/integration/orb-oauth.test.ts) scoped to src/github/backfill.ts, src/settings/agent-actions.ts, src/auth/github-oauth.ts, src/orb/oauth.ts — 540 tests passing, no uncovered lines on any changed diff line.
• npm run test:coverage (full unsharded)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New/changed behavior has unit/integration tests for the new config-driven branches (env override present/absent/blank, self-hoster origin vs cloud origin, renamed App slug, regex-metacharacter slug, blank slug fail-closed)

If any required check was skipped, explain why:

• This is a backend-only change confined to src/github, src/settings, src/orb, src/auth; no apps/gittensory-ui/**, packages/gittensory-mcp/**, test/workers/**, or wrangler.jsonc paths are touched, so the UI/MCP/workers/full-coverage jobs are left to CI's own (path-filtered) run rather than re-run locally here — db:migrations:check, db:schema-drift:check, cf-typegen:check, and selfhost:env-reference:check were also run locally and are clean/unaffected.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth/OAuth changes (items 3 and 4) include negative-path tests (rejected cloud-origin redirect, renamed-slug non-match, blank-slug fail-closed).
• API/OpenAPI/MCP behavior is unaffected; no schema changes.
• UI changes use live API data — n/a, no UI changes.
• Visible UI changes include a UI Evidence section — n/a, no UI changes.
• Public docs/changelogs are unaffected; no changelog edits.

Notes

• Rebased onto latest main immediately before pushing (picked up the concurrently-merged Make trusted-scanner-bot allowlist configurable #4614 TRUSTED_SCANNER_BOT_LOGINS change in the same file/function neighborhood; resolved cleanly, both changes coexist).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.13%. Comparing base (978cba4) to head (dc28f85).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4663   +/-   ##
=======================================
  Coverage   94.12%   94.13%           
=======================================
  Files         434      434           
  Lines       38546    38554    +8     
  Branches    14050    14053    +3     
=======================================
+ Hits        36283    36291    +8     
  Misses       1604     1604           
  Partials      659      659           

Files with missing lines	Coverage Δ
src/auth/github-oauth.ts	94.94% <ø> (ø)
src/github/backfill.ts	97.19% <100.00%> (+<0.01%)	⬆️
src/orb/oauth.ts	97.61% <100.00%> (+0.05%)	⬆️
src/settings/agent-actions.ts	97.76% <100.00%> (+0.03%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.