fix(review): derive hard-rule issue list from fresh body parse (#8354)

[milosde111]

Summary

• resolveLinkedIssueHardRule now uses a single extractLinkedIssueNumbersWithOverflow(args.body) call for both the overflow check and the per-issue fact-fetch list, so those two views of “currently linked” can never disagree.
• Direction: removed the redundant linkedIssues parameter from the signature (call sites in src/queue/processors.ts and src/services/agent-approval-queue.ts updated to stop passing pr.linkedIssues).
• Closes the edit-driven detection-bypass window where a newly added closing reference could pass overflow (fresh body) but be silently skipped because fact-fetch trusted a stale synced pr.linkedIssues array.
• Regression test (fix(review): resolveLinkedIssueHardRule's overflow check and per-issue fact-fetch read from two different sources that can disagree #8354): a body whose fresh parse yields #99 is fetched and evaluated against the hard rules.

Closes #8354

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Full test:ci / coverage / typecheck not run end-to-end on this Windows host (npm ci blocked by @codecov/bundle-analyzer platform constraint). Targeted unit suites above were run and passed; run the full local gate before push.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

N/A — backend review-path fix only.

Notes

• Empty linked-issue early-out (numbers.length === 0 → undefined) is preserved; emptiness is now sourced from the fresh parse instead of the removed parameter.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.39%. Comparing base (32f37d5) to head (9b13135).
⚠️ Report is 18 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #8475       +/-   ##
===========================================
+ Coverage   80.21%   90.39%   +10.18%     
===========================================
  Files         791      100      -691     
  Lines       79334    26052    -53282     
  Branches    23961     5083    -18878     
===========================================
- Hits        63636    23550    -40086     
+ Misses      12775     2233    -10542     
+ Partials     2923      269     -2654     

Flag	Coverage Δ
shard-1	76.86% <25.00%> (?)
shard-2	29.10% <25.00%> (-19.88%)	⬇️
shard-3	42.37% <100.00%> (-14.29%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/queue/processors.ts	95.73% <ø> (+23.01%)	⬆️
src/review/linked-issue-hard-rules.ts	98.27% <100.00%> (+0.03%)	⬆️
src/services/agent-approval-queue.ts	99.17% <ø> (ø)

... and 691 files with indirect coverage changes

[loopover-orb]

This repository reviews pull requests one-shot: the PR must be correct as originally opened. Pushing an additional commit closes it automatically instead of restarting review — open a fresh pull request with every fix included.