fix(review): repair stale gate-check publication state (#2351)

* fix(review): invalidate stale ai review cache inputs

* fix(review): fingerprint the actual REES endpoint, not just its presence

The AI-review cache fingerprint only recorded Boolean(REES_URL), so
changing the configured analyzer endpoint from one URL to another kept
the same cache key -- a same-head PR could reuse AI-review output
produced against a different analyzer service. Fingerprint the URL
value itself (still one-way-hashed by aiReviewInputFingerprint, so it
never appears in the output), matching the pattern already used for the
other REES_* fields.

* fix(review): restrict backlogged sweeps to priority repairs only

While an active per-PR regate backlog defers ordinary stale maintenance
(the point of the earlier check), a repo with even one priority repair
(a PR missing its current Gate check) escaped that deferral entirely and
picked up a full SWEEP_MAX_PRS batch -- letting unrelated ordinary stale
PRs ride along whenever any priority repair existed, contradicting the
"normal maintenance yields behind repairs" intent. Cap the candidate
limit to exactly the priority count when a backlog is active; a repo
with no backlog still gets a normal, full-size sweep.

Also documents (not fixes -- verified as a false positive) why
`decision.willLabel` in the incomplete-surface audit path is safe even
though `decision` can still be the un-reassigned `prelim` value there:
`willLabel` is a non-optional boolean on every PublicSurfaceDecision
variant, and the path is only reachable when "label" was never in
prelim.actions to begin with.

* test(review): mark the ai-review cache metadata fallback as provably unreachable

runAiReviewForAdvisory is the sole assignment site reaching the cache-write
branch, and every one of its "ok" returns sets metadata explicitly, so the
nullish fallback is a type-level safeguard only.

Author: JSONbored

src/db/repositories.ts

@@ -3334,6 +3334,7 @@ export async function getCachedAiReview(
   pullNumber: number,
   headSha: string | null | undefined,
   mode: string,
+  expectedInputFingerprint?: string | undefined,
 ): Promise<{ notes: string; reviewerCount: number; findings: AdvisoryFinding[]; metadata?: Record<string, unknown> | undefined } | null> {
   if (!headSha) return null;
   const row = await env.DB
@@ -3342,6 +3343,11 @@ export async function getCachedAiReview(
     .first<{ notes: string; reviewerCount: number; mode: string; findingsJson: string | null; metadataJson: string | null }>();
   if (!row || row.mode !== mode) return null;
   const metadata = parseJson<Record<string, unknown>>(row.metadataJson, {});
+  if (
+    expectedInputFingerprint !== undefined &&
+    metadata.inputFingerprint !== expectedInputFingerprint
+  )
+    return null;
   return {
     notes: row.notes,
     reviewerCount: row.reviewerCount,

src/env.d.ts

@@ -210,6 +210,7 @@ declare global {
     REES_SHARED_SECRET?: string;
     REES_TIMEOUT_MS?: string;
     REES_ANALYZERS?: string;
+    REES_PROFILE?: string;
     REES_FORWARD_GITHUB_TOKEN?: string;
     /** Convergence flag: the deterministic content/registry SURFACE LANE drives the gate for registry-submission
      *  PRs (metagraphed surfaces[]/providers/candidates). Truthy ON *AND* the repo in GITTENSORY_REVIEW_REPOS —