fix(review): require a real installation before acting-autonomy scans include a repo

[JSONbored]

Summary

• isAgentConfigured resolves the operator's global-default autonomy for ANY repoFullName, regardless of whether the GitHub App is installed there. A repo with only a local repositories row (e.g. a stray gittensor-subnet-registry entry with no real installation) inherited that global default and looked "agent-configured" purely by existing, even with no installation token to ever act on it.
• Adds a hasInstallation (typeof repo.installationId === "number") guard before the autonomy-based eligibility check, mirroring the same pattern across every site that copies the regate sweep's own repo-selection logic: fanOutAgentRegateSweepJobs (src/queue/processors.ts), watchedRepos in both pr-reconciliation.ts and sweep-watchdog.ts, and the scan helpers in ops-wire.ts, selftune-wire.ts, and maintainer-recap-wire.ts.
• The explicit GITTENSORY_REVIEW_REPOS allowlist path (isConvergenceRepoAllowed) is deliberately left untouched — it's an operator-typed signal independent of installation state (e.g. reviewing ahead of a pending install).
• Closes Align ops-alerts / selftune / maintainer-recap scoping with the regate sweep's isInstalled pattern #5023. Note: Align ops-alerts / selftune / maintainer-recap scoping with the regate sweep's isInstalled pattern #5023's own body assumed the regate sweep (fanOutAgentRegateSweepJobs) already correctly scoped by installation and that ops-alerts/selftune/maintainer-recap just needed to "mirror the regate sweep exactly" — investigation found the regate sweep had the identical leak, so this PR also fixes processors.ts itself plus two more call sites with the same pattern (pr-reconciliation.ts, sweep-watchdog.ts) that weren't in Align ops-alerts / selftune / maintainer-recap scoping with the regate sweep's isInstalled pattern #5023's stated scope.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves — Closes Align ops-alerts / selftune / maintainer-recap scoping with the regate sweep's isInstalled pattern #5023.

Validation

• git diff --check
• npm run actionlint (via npm run test:ci)
• npm run typecheck
• npm run test:coverage locally — 100% branch/line coverage on every changed line across all 6 files (verified via targeted --coverage.include runs per file; the only residual gaps flagged by v8 are pre-existing branches on lines my diff did not touch).
• npm run test:workers (via npm run test:ci)
• npm run build:mcp (via npm run test:ci)
• npm run test:mcp-pack (via npm run test:ci)
• npm run ui:openapi:check (via npm run test:ci) — no API/schema changes in this PR.
• npm run ui:lint (via npm run test:ci)
• npm run ui:typecheck (via npm run test:ci)
• npm run ui:build (via npm run test:ci)
• npm audit --audit-level=moderate — 0 vulnerabilities.
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries — regression tests added/extended in queue.test.ts, selftune-wiring.test.ts, and ops-wire.test.ts; pr-reconciliation.test.ts, sweep-watchdog.test.ts, and maintainer-recap-wire.test.ts already had fixtures that exercise the new guard's both branches.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/session surface touched.)
• API/OpenAPI/MCP behavior is updated and tested where needed. (N/A — internal scan-selection logic only.)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (N/A — no UI changes.)
• Visible UI changes include a UI Evidence section. (N/A — no UI changes.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (N/A.)

Notes

• This is a backend-only, non-UI fix; no UI Evidence section is included.

[superagent-security]

Superagent did not find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.13%. Comparing base (af46a90) to head (6d8c043).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5052      +/-   ##
==========================================
- Coverage   94.13%   94.13%   -0.01%     
==========================================
  Files         465      465              
  Lines       39536    39542       +6     
  Branches    14428    14431       +3     
==========================================
+ Hits        37217    37222       +5     
  Misses       1664     1664              
- Partials      655      656       +1     

Flag	Coverage Δ
shard-1	46.49% <37.50%> (-0.03%)	⬇️
shard-2	33.39% <37.50%> (-0.12%)	⬇️
shard-3	31.59% <25.00%> (+0.25%)	⬆️
shard-4	32.65% <12.50%> (-0.03%)	⬇️
shard-5	33.25% <0.00%> (-0.20%)	⬇️
shard-6	45.15% <12.50%> (+0.22%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/queue/processors.ts	95.39% <100.00%> (+<0.01%)	⬆️
src/review/maintainer-recap-wire.ts	98.07% <100.00%> (-1.93%)	⬇️
src/review/ops-wire.ts	98.27% <100.00%> (+1.78%)	⬆️
src/review/pr-reconciliation.ts	100.00% <100.00%> (ø)
src/review/selftune-wire.ts	96.66% <100.00%> (-3.34%)	⬇️
src/review/sweep-watchdog.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.