feat(maintainer): reconcile stored author_association to live GitHub roles

[anderdc]

Summary

author_association is snapshotted at mirror-ingest time and never refreshed. If a contributor becomes (or stops being) a maintainer after a row is ingested, every stored PR/issue/review/comment row keeps the stale role forever. Scoring that reads the per-row snapshot (the issue-bonus tier in entrius/gittensor) is then permanently wrong for those authors.

Concrete miss on phase-rs/phase: matthewevans (id 1388610, currently MEMBER) and plind-junior (id 59729252, currently COLLABORATOR) have every stored row stuck at CONTRIBUTOR — they were private collaborators when the rows were ingested. The /repos/:repo/maintainers view already reports the correct current role (it derives latest-known role), and the maintainer_cut carve-out already trusts it, but the raw per-row columns scoring reads do not.

Fix

A new MaintainerRoleReconcileService (hourly @Cron) that, for registered + installed repos only (registered = true AND installation_id IS NOT NULL):

1. Pulls the live maintainer set from GitHub — direct collaborators (GET /repos/{owner}/{repo}/collaborators?affiliation=direct) + org members (GET /orgs/{org}/members).
2. Promotes: rewrites each current maintainer's rows to their live association across the four association-bearing tables (pull_requests, issues, comments, reviews) — the same set contributor_repo_roles reads.
3. Demotes: anyone still flagged OWNER/MEMBER/COLLABORATOR who is no longer in the live set is reset to CONTRIBUTOR.

After this runs, the stored snapshot reflects current role, so the downstream validator check stays the trivial author_association IN (...) — no validator-side workaround needed.

Safety

• Fetches both sets before any write, and fails closed per-repo: a fetch/DB error skips that repo (caught, logged) so a partial fetch can never read as a mass demotion; the next sweep retries.
• An empty maintainer set from a non-throwing GitHub response is treated as suspicious and skipped (a real repo always has its owner), rather than demoting every contributor.
• RETURNING 1 row-counts make promote/demote logging version-independent.
• Reuses GitHubFetcherService's existing installation-token cache + rate-limit-aware githubFetch.

What this does NOT change

• No schema change. Columns are rewritten in place (author_association is a scoring-support field, not an audit record).
• Near-real-time member/membership/organization webhook triggers are intentionally out of scope — the hourly sweep is the v1; webhooks can tighten the window later.

Dependency

Adds @nestjs/schedule@^4.1.2 (Nest 10-compatible) + ScheduleModule.forRoot(). The existing reconcilers (PrReconcileService, etc.) self-schedule with setInterval; this introduces @nestjs/schedule as the cleaner standard going forward.

Lockfile note

package-lock.json shows a large delete count because npm install also pruned pre-existing extraneous entries that were stale on test (redis/@redis/*, generic-pool, chokidar deps — not referenced by the current package.json tree; verified keyv/@keyv/redis still resolve). The only additions are @nestjs/schedule, cron, @types/luxon. Happy to split the pruning into a separate hygiene PR if preferred.

Testing

• npm run build — clean (tsc via nest build).
• npm run lint — clean (eslint + prettier).
• No test files included, per request.