fix(gate): unconditional secret-leak block; don't let inconclusive AI bury blockers

[JSONbored]

Summary

Closes audit findings 3.4 and 3.5 (the concrete, high-value parts of the AI-safety cluster).

• 3.4 — the secret-leak scan only ran when GITTENSORY_REVIEW_SAFETY was ON and the repo was allowlisted, so a registered-but-not-allowlisted repo got zero secret-leak gate while the engine still auto-merged/closed. A real-format committed credential (github_token, aws_access_key, …) is a leak on any repo, so maybeAddSecretLeakFinding now runs unconditionally against the resolved diff. secretLeakFinding already filters to HARD_SECRET_KINDS (the weak heuristics that false-positive on config/workflow content are dropped), so it never mis-fires; the prompt-injection defang and AI review stay flag-gated.
• 3.5 — evaluateGateCheck returned a neutral "held for human" and dropped every configured deterministic blocker the instant an AI review was ai_review_inconclusive. A contributor who forced a non-JSON / budget-exhausted AI result could bury a PR's real violations (secret_leak, duplicate, missing-issue, slop, quality) in a hold. The inconclusive hold is now evaluated after deterministic blockers and only when none fired — a real violation still hard-blocks; a clean PR with an inconclusive AI is still held (never auto-closed on a model hiccup).

3.3 (strengthening the prompt-injection keyword blocklist) is deferred: per the audit it's flag-gated, on for the live repos, and can only downgrade (suppress an AI hold) — a larger redesign best done on its own.

Scope

• Backend only (src/queue/processors.ts, src/rules/advisory.ts, src/review/safety.ts); no schema change; no migration

Validation

• npm run test:ci — full gate green
• npm audit --audit-level=moderate — 0 vulnerabilities
• Updated tests: a leaked secret now fails the gate flag-OFF / unset; new test: a secret_leak still fails even when the AI is inconclusive
• Every changed line + branch covered

Safety

• No secrets / wallets / hotkeys / trust scores / reward values; both changes fail toward blocking a real violation
• No site/ / CNAME / lovable

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.96%. Comparing base (f058338) to head (73acbaa).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1237      +/-   ##
==========================================
- Coverage   94.96%   94.96%   -0.01%     
==========================================
  Files         177      177              
  Lines       19779    19776       -3     
  Branches     7115     7112       -3     
==========================================
- Hits        18783    18780       -3     
  Misses        397      397              
  Partials      599      599              

Files with missing lines	Coverage Δ
src/queue/processors.ts	86.42% <ø> (-0.04%)	⬇️
src/review/safety.ts	100.00% <ø> (ø)
src/rules/advisory.ts	97.22% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.