feat(enrichment): detect GitHub Actions workflow-injection and pwn-request risk

[joaovictor91123]

Summary

Adds review-enrichment/src/analyzers/workflow-injection.ts, a new REES analyzer that flags the GitHub Actions "pwn request" trust-boundary pattern: a pull_request_target/workflow_run workflow (which runs with the base repo's secrets and token even for a fork PR) that checks out the untrusted PR head, interpolates untrusted event fields (PR title/body/head ref, issue/comment body) directly into a run: shell step instead of via env:, or carries no narrowed permissions: block. Registered in registry.ts/analyzer-metadata.json alongside the existing actionPin/iacMisconfig analyzers, whose shape it follows.

No issue is linked: this repo's linkedIssuePolicy is preferred, not required, and the proposal, rationale, and full test plan are self-contained in this PR. I checked for duplicates first: PR #2668 (workflowPermissions) proposed a related but narrower analyzer (permission-escalation flags and bare trigger-declaration detection) and was closed for a specific correctness bug in its trigger tracking; it never merged, so nothing in main covers this today. This PR does not overlap it — it targets the untrusted-checkout and shell-injection vectors #2668 didn't attempt — and its own trigger detection reads both added and unchanged context lines in a hunk (not just added lines gated behind seeing on: in the same hunk), which avoids the specific defect that got #2668 closed.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• npm run test:mcp-pack crashes on my local Windows dev machine with a pre-existing, unrelated ERR_INVALID_ARG_TYPE in scripts/check-mcp-package.mjs that I confirmed reproduces identically on a clean, unmodified main checkout — it is a local Node/Windows environment issue, not something this PR introduces. Likewise npm run ui:lint and part of npm run test:coverage show failures on this machine (CRLF-vs-LF noise across the whole apps/gittensory-ui tree from core.autocrlf, and ~30 shell/script-based test files that need bash/sentry-cli/docker tooling this Windows box doesn't have); I verified every one of these also fails identically on a clean main checkout, so I'm listing them as run rather than skipped, with this caveat. The new analyzer's own test suite (review-enrichment/test/workflow-injection.test.ts, run via npm run rees:test) passes in full (10/10), and the full review-enrichment suite is green apart from those same 2 pre-existing sentry-upload.test.ts failures.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Not applicable — this PR adds a new REES analyzer (backend/enrichment logic) with an accompanying apps/gittensory-ui/src/lib/rees-analyzers.ts metadata entry, but no new visible UI surface.

Notes

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.