feat(selfhost): allow per-repo AI CLI timeout overrides in review.ai_model (#8364)

[andriypolanski]

Summary

• Closes AI CLI timeout knobs are env-var-only, unlike the sibling model/effort knobs (config-as-code gap) #8364
• Adds optional .loopover.yml fields under review.ai_model: claude_timeout_ms, codex_timeout_ms, claude_first_output_timeout_ms, codex_first_output_timeout_ms (same section as claude_model / claude_effort).
• Threads them through AiRunOptions / runLoopOverAiReview / the CLI providers; resolve*TimeoutMs prefer a positive per-repo override, else keep today’s env-var/effort resolution.
• Bumps AI review cache fingerprint to ai-review-input:v6 so a timeout-only manifest change invalidates cached reviews.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• Targeted vitest: selfhost-ai timeout suites, focus-manifest review.ai_model, ai-review override forwarding, ai-review-cache-input
• npm run test:coverage
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• config-lint.ts only validates top-level manifest keys (review is already recognized). Nested review.ai_model.* fields are recognized the same way claude_model already is — by parsing in focus-manifest.ts, not a nested allowlist in config-lint. Untouched CI surfaces left to CI.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.63%. Comparing base (af3340f) to head (8307c67).
⚠️ Report is 16 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #8435       +/-   ##
===========================================
+ Coverage   59.66%   93.63%   +33.97%     
===========================================
  Files         791      694       -97     
  Lines       79319    56639    -22680     
  Branches    23952    20103     -3849     
===========================================
+ Hits        47325    53034     +5709     
+ Misses      28250     2652    -25598     
+ Partials     3744      953     -2791     

Flag	Coverage Δ
control-plane	?
rees	?
shard-1	58.03% <55.88%> (?)
shard-2	50.07% <38.23%> (+2.41%)	⬆️
shard-3	54.35% <82.35%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/loopover-engine/src/focus-manifest.ts	98.75% <100.00%> (+51.73%)	⬆️
src/queue/ai-review-orchestration.ts	100.00% <100.00%> (+45.03%)	⬆️
src/review/ai-review-cache-input.ts	100.00% <100.00%> (+47.27%)	⬆️
src/selfhost/ai.ts	98.19% <100.00%> (+0.01%)	⬆️
src/services/ai-review.ts	96.92% <100.00%> (+49.44%)	⬆️

... and 572 files with indirect coverage changes

[loopover-orb]

This repository reviews pull requests one-shot: the PR must be correct as originally opened. Pushing an additional commit closes it automatically instead of restarting review — open a fresh pull request with every fix included.