feat(miner): wire per-repo kill switch, real claim-ledger, and CI-status observation

[JSONbored]

Summary

• Wires the real per-repo .gittensory-miner.yml kill switch into attempt-cli.js's live pipeline (checkMinerKillSwitch + the Governor context), closing a gap that was previously only checked globally.
• Wires real soft-claim writes into claim-ledger.js from attempt-cli.js -- claimed once an attempt passes feasibility, released on every terminal outcome. The local claim ledger was never actually written to in the real pipeline before this.
• Adds a real CI-status observation to loop-cli.js's post-submission handling, using ci-poller.js's real GitHub check-run polling, recorded to the event ledger and surfaced in --json cycle output as ciConclusion.

A note on scope vs #5394's stated preference

#5394 named gate-verdict-poller.js (#4273) as the preferred source for this signal. Investigation found it has no real caller-reachable endpoint today: the only matching route (GET /v1/contributors/:login/open-pr-monitor) returns a list of { classification: OpenPrWorkClassification } packets across every open PR for a login, not the single decided { disposition | gateDisposition | verdict } field gate-verdict-poller.js's own readGateDisposition expects for one PR. Wiring it as-is would have silently always resolved to pending. Used ci-poller.js instead -- the issue's own documented fallback -- and left a header comment on gate-verdict-poller.js explaining the mismatch for whoever picks up a real single-PR gate-decision route later.

Test plan

• tsc --noEmit --incremental false clean
• npx vitest run test/unit -- 15091/15104 passing (1 unrelated pre-existing flake in miner-repo-clone.test.ts, a real-git-clone test that occasionally exceeds its 15s timeout under load; unrelated to any file in this PR)
• npm run test:coverage (unsharded) -- same result
• Per-file patch coverage verified line-by-line against the diff: 100% on all new/changed lines in attempt-cli.js, attempt-input-builder.js, and loop-cli.js
• npm audit --audit-level=moderate -- 0 vulnerabilities
• git diff --check clean

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	3986cb9	Commit Preview URL Branch Preview URL	Jul 12 2026, 07:33 PM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.46%. Comparing base (156b382) to head (3986cb9).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5429   +/-   ##
=======================================
  Coverage   94.46%   94.46%           
=======================================
  Files         554      554           
  Lines       44426    44438   +12     
  Branches    14663    14663           
=======================================
+ Hits        41967    41979   +12     
  Misses       1784     1784           
  Partials      675      675           

Flag	Coverage Δ
shard-1	43.86% <0.00%> (-0.26%)	⬇️
shard-2	34.89% <64.28%> (+0.13%)	⬆️
shard-3	31.65% <0.00%> (+0.06%)	⬆️
shard-4	31.42% <0.00%> (+<0.01%)	⬆️
shard-5	32.89% <0.00%> (-0.40%)	⬇️
shard-6	43.83% <35.71%> (+0.46%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/gittensory-miner/lib/attempt-cli.js	96.71% <100.00%> (+0.15%)	⬆️
...ages/gittensory-miner/lib/attempt-input-builder.js	100.00% <ø> (ø)
...ckages/gittensory-miner/lib/gate-verdict-poller.js	96.96% <ø> (ø)
packages/gittensory-miner/lib/loop-cli.js	93.39% <100.00%> (+0.15%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.