fix: prevent self-merge recommended-XP loop (#873)

[ionfwsrijan]

Problem

A user who merged their own PR could receive XP both from the normal merge event and from the recommended-PR award path, double-crediting self-merges and letting users farm XP by merging their own recommendations.

Fix

• New shared helper isSelfMerge(repoFullName, githubLogin) (strict owner/repo shape, case-insensitive owner match) so handleMerge and both claim actions cannot drift.
• The guard is hoisted to the top of handleMerge and also enforced inside awardRecommendedMerge.
• claimIssue and claimRecommendation reject forbidden on self-merge.

Files changed

• src/lib/xp/self-merge.ts (new)
• src/inngest/functions/process-pr-event.ts
• src/app/actions/issues.ts
• src/app/actions/recommendations.ts
• Tests: self-merge.test.ts, plus claim/denial tests

Testing

• Full MergeShip suite passes.
• New tests cover the self-merge denial in both the event handler and claim actions.

Closes #873

[vercel]

@ionfwsrijan is attempting to deploy a commit to the codersogs-3057's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Hey @ionfwsrijan

You have 7 open PRs right now. The limit is 3 at a time.

Please get your existing PRs merged or closed before opening new ones:

• fix: usage week aligns with UTC calendar week (#875) #880 - fix: usage week aligns with UTC calendar week ([BUG] Usage page's "week XP" is a rolling 7×24h window, not a calendar week — inconsistent with the calendar-day "today" and with the platform's weekly analytics #875)
• fix: revoke stale per-repo grants (#874) #879 - fix: revoke stale per-repo grants ([BUG] Revoked per-repo maintainer grants are never cleaned up — installation_user_repos rows persist forever after a collaborator is demoted #874)
• fix: reconcile merged-PR XP across all installs and pages (#872) #877 - fix: reconcile merged-PR XP across all installs and pages ([BUG] reconcileMergedPrXp never scans beyond the first 50 installs, first 20 repos, or the first 100 closed PRs — lost merge XP is permanently unrecoverable on busy repos #872)
• fix: exact maintainer status check with negative-cache lockdown (#871) #876 - fix: exact maintainer status check with negative-cache lockdown ([BUG] isUserMaintainer truncates the grant check to 20 junction rows and caches the result for 1h — maintainers with many installs are wrongly locked out #871)
• fix: maintainer queue pagination with in-SQL filters and exact counts #868 - fix: maintainer queue pagination with in-SQL filters and exact counts

This PR will remain open but won't be reviewed until you're under the limit. See our Contributing Guidelines for details.

[ionfwsrijan]

@jakharmonika364 @Soumya-codr Please review this

[jakharmonika364]

LGTM