feat(selfhost): gate priority label on linked-issue label propagation (#2750)

* feat(selfhost): gate priority label on linked-issue label propagation

gittensor:priority is a maintainer reward/bonus label and must never be
inferred from a PR's title, changed files, AI output, or existing PR
labels. Delete the content-glob-based priority inference in
resolvePrTypeLabel and replace it with a generic, config-driven
linkedIssueLabelPropagation setting: a mapped PR label is only ever
applied when a linked/closing issue already carries the configured
issue label, fetched fail-open (a fetch failure never invents a
priority label). Exclusive mappings replace the bug/feature
classification entirely (the gittensor:priority case); additive
mappings apply alongside it, for a self-hoster's own unrelated
label pair. Also add typeLabels for per-repo label-name overrides.

* fix(selfhost): keep the linked-issue-label-propagation fetch out of the UI typecheck

Splitting the GitHub-fetch orchestrator into its own file
(linked-issue-label-propagation-fetch.ts) keeps
linked-issue-label-propagation.ts limited to pure config types and
the normalizer. focus-manifest.ts imports that pure module, and
focus-manifest.ts is itself pulled into the gittensory-ui workspace's
isolated typecheck via registration-workspace.ts, which has no
visibility into the Worker's ambient Env type -- the fetch
orchestrator's github/app + github/backfill imports broke
ui:typecheck by dragging that whole module graph in. Also regenerate
the stale env-reference file and close two branch-coverage gaps.

* test(selfhost): close the last patch-coverage gap in the type-label block

settings.typeLabels is optional only for RepositorySettings-fixture
backward compat, same as typeLabelsEnabled above it -- getRepositorySettings
always resolves it to a concrete PrTypeLabelSet, so the ?? DEFAULT_TYPE_LABELS
fallback is unreachable on this webhook-integration path.

* fix(selfhost): cap the linked-issue label propagation fetch fan-out

pr.linkedIssues is already hard-capped to MAX_LINKED_ISSUE_NUMBERS (50)
at extraction time, so this Promise.all could never actually exceed
that in production -- but the function itself trusted every caller to
have gone through the capped extractor first. Add a local cap as a
second, self-contained line of defense, and document why the bare
Promise.all needs no per-item catch (fetchLinkedIssueFacts already
fails open internally).

* fix(selfhost): preserve DB values for unnamed typeLabels/propagation keys

A partial .gittensory.yml override naming only one typeLabels or
linkedIssueLabelPropagation field (e.g. typeLabels.priority) previously
reset the other fields to the built-in defaults instead of preserving
the DB-persisted values, violating the documented yml > DB > defaults
precedence. Parse these two settings as sparse partials and merge them
field-by-field in resolveEffectiveSettings.

* test(selfhost): cover the missing linkedIssueLabelPropagation DB-default branch

codecov/patch flagged a partial branch left by the prior commit: the
dbSettings.linkedIssueLabelPropagation ?? DEFAULT fallback in
resolveEffectiveSettings was never exercised with no DB value present,
unlike its already-covered typeLabels counterpart.

* fix(selfhost): validate sparse-override fields before merging them

A present-but-malformed nested field (e.g. typeLabels.priority: 123,
or linkedIssueLabelPropagation.mappings: "oops") was still copied into
the sparse manifest override using the normalizer's built-in-default
fallback, silently overwriting a DB-persisted value on a config typo
instead of being ignored. Gate each field on its own raw shape before
copying it. Also reject a non-boolean removeOtherTypeLabels instead of
silently coercing it to false, which could flip an intended-exclusive
mapping to additive, and validate linkedIssueLabelPropagation.enabled
the same way. Fixes a doc-comment pointing at the wrong file.

Author: JSONbored

.gittensory.yml.example

@@ -293,15 +293,43 @@ settings:
   # The label name to apply. String. Default: gittensor.
   gittensorLabel: gittensor
 
-  # Apply the per-PR TYPE/taxonomy label -- exactly one of gittensor:bug / gittensor:feature /
-  # gittensor:priority, classified from the PR title + changed paths (#label-decoupling). Independent of
-  # `autoLabelEnabled` above (which only governs the base `gittensorLabel` context label): a type label is
-  # internal triage metadata, so it applies to every PR regardless of author type (bot/maintainer/missing
-  # author) or `publicAudienceMode`/`publicSurface`, UNLESS `publicAudienceMode: gittensor_only` is muting
-  # this PR's author entirely (that mode's whole point is total silence for a non-confirmed-miner author).
+  # Apply the per-PR TYPE/taxonomy label -- bug/feature by the PR title, or priority via
+  # `linkedIssueLabelPropagation` below (#label-decoupling). Independent of `autoLabelEnabled` above
+  # (which only governs the base `gittensorLabel` context label): a type label is internal triage
+  # metadata, so it applies to every PR regardless of author type (bot/maintainer/missing author) or
+  # `publicAudienceMode`/`publicSurface`, UNLESS `publicAudienceMode: gittensor_only` is muting this
+  # PR's author entirely (that mode's whole point is total silence for a non-confirmed-miner author).
   # Bool. Default: true.
   typeLabelsEnabled: true
 
+  # Per-repo override of the three TYPE label NAMES. Omit any key to keep its default. Map with
+  # string values bug/feature/priority. Default: gittensor:bug / gittensor:feature / gittensor:priority.
+  # typeLabels:
+  #   bug: gittensor:bug
+  #   feature: gittensor:feature
+  #   priority: gittensor:priority
+
+  # Linked-issue label propagation (#priority-linked-issue-gate): the ONLY mechanism that can select a
+  # label like `gittensor:priority` -- it is NEVER inferred from a PR's title, changed files, AI
+  # output, or existing PR labels, only ever copied from a linked/closing issue ("Fixes #123") that
+  # ALREADY carries the configured issue label. Generic beyond the priority use case: any issue label
+  # can map to any PR label. `removeOtherTypeLabels: true` REPLACES the type label entirely (bug/
+  # feature are removed), matching how `gittensor:priority` behaves today; `false` applies the mapped
+  # label ADDITIVELY alongside the normal title-based bug/feature label, leaving it untouched -- useful
+  # for a mapping unrelated to the bug/feature/priority triad (e.g. a `customer:vip` issue label
+  # copied to a `triage:vip` PR label). Disabled by default (no mappings) -- a self-hoster opts in per
+  # repo. If your labels carry reward or moderation weight, configure this in PRIVATE per-repo/global
+  # config (see `config/examples/README.md`) rather than the public `.gittensory.yml`, so contributors
+  # cannot see the exact mapping rules. A per-repo `mappings` override in the private-config layer
+  # REPLACES the global default list wholesale -- it does not merge with it.
+  # linkedIssueLabelPropagation:
+  #   enabled: true
+  #   mode: exclusive_type_label
+  #   mappings:
+  #     - issueLabel: gittensor:priority
+  #       prLabel: gittensor:priority
+  #       removeOtherTypeLabels: true
+
   # Create the label if it does not yet exist. Bool. Default: true.
   createMissingLabel: true
 
@@ -336,7 +364,9 @@ settings:
   #   1. Context label (`gittensorLabel`, gated by `autoLabelEnabled` above) — the base per-PR marker shown
   #      to the public surface, subject to `publicAudienceMode`/`publicSurface`/author-qualification.
   #   2. Taxonomy/type label (`gittensor:bug`/`gittensor:feature`/`gittensor:priority`, gated by
-  #      `typeLabelsEnabled` above) — internal triage metadata, applied independently of #1.
+  #      `typeLabelsEnabled` above) — internal triage metadata, applied independently of #1. bug/
+  #      feature come from the PR title; priority ONLY from `linkedIssueLabelPropagation` above —
+  #      never inferred from title, files, AI, or existing PR labels (#priority-linked-issue-gate).
   #   3. Autonomy-outcome labels (`gittensory:ready-to-merge` etc.) — gated by the `review_state_label`
   #      autonomy class below, advisory commentary on the bot's own verdict.
   #   4. Anti-abuse enforcement labels (blacklist/contributor-cap/review-nag) — gated by the `close`

apps/gittensory-ui/public/openapi.json

@@ -8969,6 +8969,66 @@
           },
           "typeLabelsEnabled": {
             "type": "boolean"
+          },
+          "typeLabels": {
+            "type": "object",
+            "properties": {
+              "bug": {
+                "type": "string"
+              },
+              "feature": {
+                "type": "string"
+              },
+              "priority": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "bug",
+              "feature",
+              "priority"
+            ]
+          },
+          "linkedIssueLabelPropagation": {
+            "type": "object",
+            "properties": {
+              "enabled": {
+                "type": "boolean"
+              },
+              "mode": {
+                "type": "string",
+                "enum": [
+                  "exclusive_type_label"
+                ]
+              },
+              "mappings": {
+                "type": "array",
+                "items": {
+                  "type": "object",
+                  "properties": {
+                    "issueLabel": {
+                      "type": "string"
+                    },
+                    "prLabel": {
+                      "type": "string"
+                    },
+                    "removeOtherTypeLabels": {
+                      "type": "boolean"
+                    }
+                  },
+                  "required": [
+                    "issueLabel",
+                    "prLabel",
+                    "removeOtherTypeLabels"
+                  ]
+                }
+              }
+            },
+            "required": [
+              "enabled",
+              "mode",
+              "mappings"
+            ]
           }
         },
         "required": [