feat(selfhost): local-inference binding for advisory-tier AI capabilities (AI_ADVISORY) (#4388)

Only the core PR review needs frontier-model accuracy -- it drives real
gate blockers. Slop advisory, e2e test-gen, the issue planner, and AI
summaries/rewrite are all advisory-only (never gate-blocking) and were
sharing the same frontier claude-code/codex chain purely because no
cheaper alternative existed, silently spending real subscription tokens
on every PR regardless of the repo's review-effort setting (which only
ever threaded through the core review path).

Adds env.AI_ADVISORY, wired in src/server.ts mirroring AI_EMBED/AI_VISION's
exact pattern (AI_ADVISORY_BASE_URL/_MODEL/_API_KEY, createOpenAiCompatibleAi,
absent-binding fallback to env.AI). Routing is config-driven per capability
via .gittensory.yml settings.advisoryAiRouting (global default + per-repo
override, config-as-code only, mirrors unlinkedIssueGuardrail's shape) --
never hardcoded, and a capability only actually routes through the local
binding when both the yml opt-in AND the binding itself are configured.

Wired at all four real call sites via a shared withAdvisoryAiEnv helper
(src/selfhost/ai.ts): runAiSlopForAdvisory, the e2e-test-gen delivery
path, the issue-planner command handler, and the agent-run AI summary
attachment. Zero risk to the core review's accuracy since that path is
untouched.

Author: JSONbored

.env.example

@@ -619,6 +619,19 @@ REDIS_URL=redis://redis:6379                # REQUIRED for the self-host review
 #                                            #   BYOK (anthropic/openai) key; this gives self-host a local option.
 #                                            #   Unset = visual-vision falls back to BYOK-only.
 # AI_VISION_API_KEY=                         # bearer credential for AI_VISION_BASE_URL, if it requires one.
+# AI_ADVISORY_MODEL=qwen3:8b                  # local-inference model for advisory-only capabilities (#4364):
+#                                            #   slop advisory, e2e test-gen, issue planner, AI summaries -- none
+#                                            #   are gate-blocking, so none need frontier-model accuracy. Only
+#                                            #   used when AI_ADVISORY_BASE_URL is also set.
+# AI_ADVISORY_BASE_URL=                      # route the four advisory-only capabilities above to a SEPARATE
+#                                            #   openai-compatible endpoint (e.g. a local Ollama) instead of the
+#                                            #   shared frontier claude-code/codex chain. Unset = every advisory
+#                                            #   capability stays on the shared chain. Even when set, a
+#                                            #   capability only actually routes through it once the repo's
+#                                            #   .gittensory.yml settings.advisoryAiRouting also opts it in
+#                                            #   (global default + per-repo override) -- this binding alone
+#                                            #   changes nothing.
+# AI_ADVISORY_API_KEY=                       # bearer credential for AI_ADVISORY_BASE_URL, if it requires one.
 
 # --- Gittensory Orb (#1255; ALWAYS-ON fleet-calibration telemetry) ---
 # TELEMETRY NOTICE: running this self-hosted image contributes anonymized gate-calibration data to

.gittensory.yml.example

@@ -876,6 +876,18 @@ settings:
   #   action: close                          # close is the only supported value. Default: close.
   #   message: "Custom close reason..."      # Default: null (built-in message).
 
+  # Advisory-AI routing (#4364): per-capability opt-in to the local-inference AI_ADVISORY binding for these
+  # four capabilities, none of which are ever gate-blocking, so none need frontier-model accuracy. Set a
+  # global default here (or in the shared/root config) and override per-repo; a capability only actually
+  # routes through AI_ADVISORY when BOTH this is true AND the AI_ADVISORY_BASE_URL binding is configured --
+  # absent either one, it stays on the shared frontier env.AI chain (byte-identical to before). All off by
+  # default.
+  # advisoryAiRouting:
+  #   slop: false          # gate.slop.aiAdvisory's second opinion. Default: false.
+  #   e2eTestGen: false    # Auto-generated E2E test scaffolding. Default: false.
+  #   planner: false       # The @gittensory plan / issue-planner completion. Default: false.
+  #   summaries: false     # AI summaries/rewrite text. Default: false.
+
 # Maintainer AI review tuning (`.gittensory.yml` top-level `review:` block). These knobs shape the advisory AI
 # review prompt and file selection only — gate/slop/secret-scan are unaffected.
 # review: