fix(engine): diffFilePriority's vendored-directory pattern misses vendored/third_party/third-party/bower_components/jspm_packages (#7540)

* fix(engine): diffFilePriority's vendored-directory pattern misses vendored/third_party/third-party/bower_components/jspm_packages

diffFilePriority's priority-4 ("least-useful-to-review, never real collision
evidence") directory alternation only matched vendor (singular), while the
sibling isVendoredFileFrom matcher in path-matchers.ts already recognized
vendored, third_party, third-party, bower_components, and jspm_packages too.
A file shared between two unrelated PRs under one of those paths was ranked
priority 0 (ordinary source) instead of 4, inflating sharesMeaningfulFile's
collision/duplicate-cluster signal on exactly the kind of vendored-artifact
path both call sites' own doc comments say should be excluded.

Closes #7526

* chore: retrigger CI (transient Codecov GPG signature verification failure)

The previous CI run's Codecov upload step failed on both shards with
"gpg: no valid OpenPGP data found" / "Can't check signature: No public
key" -- a transient Codecov CLI key-server issue during a narrow ~10s
window, unrelated to this PR's code (a separate PR's run minutes earlier
uploaded successfully with the identical action). Empty commit to force
a fresh CI run since re-running the existing workflow run requires admin
rights on JSONbored/loopover this account doesn't have.

Author: claytonlin1110

packages/loopover-engine/src/review/diff-file-priority.ts

@@ -2,7 +2,10 @@ import { isTestPath } from "../signals/test-evidence.js";
 
 export function diffFilePriority(path: string): number {
   if (/(^|\/)(package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lock|bun\.lockb|cargo\.lock|poetry\.lock|pipfile\.lock|composer\.lock|gemfile\.lock|go\.sum|go\.work\.sum|uv\.lock|packages\.lock\.json|flake\.lock|deno\.lock|pubspec\.lock|podfile\.lock|mix\.lock|package\.resolved|gradle\.lockfile|pdm\.lock|conan\.lock|pixi\.lock|cartfile\.resolved|gopkg\.lock|shard\.lock|rebar\.lock|renv\.lock|chart\.lock)$|\.(min\.(js|css)|map|snap)$/i.test(path)) return 4;
-  if (/(^|\/)(dist|build|out|coverage|vendor|node_modules)\//i.test(path)) return 4;
+  // Must stay in sync with signals/path-matchers.ts's isVendoredFileFrom -- the two already had this
+  // obligation implicitly (bower_components/jspm_packages were added there in #2777 with no corresponding
+  // update here, #7526) and now match the same directory-name set exactly.
+  if (/(^|\/)(dist|build|out|coverage|vendor|vendored|third_party|third-party|node_modules|bower_components|jspm_packages)\//i.test(path)) return 4;
   if (/\.(md|mdx|markdown|rst|adoc|asciidoc|txt)$/i.test(path)) return 2;
   if (isTestPath(path)) return 1;
   return 0;

packages/loopover-engine/test/diff-file-priority.test.ts

@@ -30,3 +30,23 @@ test("predictedGateEngineInternals.sharesMeaningfulFile: a shared Cartfile.resol
   );
   assert.equal(predictedGateEngineInternals.sharesMeaningfulFile(["src/app.ts"], ["src/app.ts"]), true);
 });
+
+test("diffFilePriority: ranks every vendored-directory name path-matchers.ts's isVendoredFileFrom recognizes (#7526)", () => {
+  assert.equal(diffFilePriority("vendor/x.js"), 4);
+  assert.equal(diffFilePriority("vendored/x.js"), 4);
+  assert.equal(diffFilePriority("third_party/x.js"), 4);
+  assert.equal(diffFilePriority("third-party/x.js"), 4);
+  assert.equal(diffFilePriority("bower_components/x.js"), 4);
+  assert.equal(diffFilePriority("jspm_packages/x.js"), 4);
+});
+
+test("predictedGateEngineInternals.sharesMeaningfulFile: a file shared only under a vendored directory is not meaningful collision evidence (#7526)", () => {
+  assert.equal(
+    predictedGateEngineInternals.sharesMeaningfulFile(["third_party/lib.js"], ["third_party/lib.js"]),
+    false,
+  );
+  assert.equal(
+    predictedGateEngineInternals.sharesMeaningfulFile(["bower_components/lib.js"], ["bower_components/lib.js"]),
+    false,
+  );
+});