feat(orb): content-addressed decision records on every verdict

[JSONbored]

What

Every terminal verdict now persists a content-addressed decision record, and the public review surface renders it. Closes #8836 (epic #8828, Phase 4 — the highest impact/cost item of the trust-surface research). Stacked on #8840 (migration contiguity: 0179 follows its 0178).

Why

A contributor closed by ORB today cannot see which ruleset version or clause closed them — and the authoritative config being private (the operator's config dir overrides the public yml) makes that worse. The remedy from the epic's research: publish the digest even where contents stay private. "The bot closed me" becomes "clause guardrail_hold of config abc123… decided this" — inspectable, arguable, and stable under challenge. The shape follows SLSA's Verification Summary Attestation, which exists for exactly this delegated-decision pattern.

This record is also the input schema the golden-corpus replay (#8832) and the deterministic replay harness (#8838) consume — one schema, three consumers, so "what we published" and "what we can replay" can never drift apart.

How

• canonicalJson — recursively key-sorted, whitespace-free, the ONE serialization every digest is computed over. Key order is a construction artifact, never meaning; un-JSON-able values throw loudly (a silent wrong digest is worse). Property-tested: key-order invariance at depth, array-order preservation, unicode stability.
• DecisionRecord — action (the acted disposition, never the raw conclusion — gate_decision can contradict the action taken — stale 'merge' verdicts recorded after CI-failure closes distort calibration #8825's lesson), the clause (reasonCode, same expression as recordNativeGateDecision at the same site, so record and calibration row can never disagree about why), resolved-config digest, gate pack, and model/prompt commitments (null for rule-only decisions; AI-review wiring is the tracked follow-up).
• Persistence (migration 0179): latest-finalize-wins per (target, head sha), best-effort — legibility must never break finalization. The stored JSON is the canonical form: re-digesting the stored bytes reproduces the stored digest (tested — that is the replay check).
• Public surface: the unified comment appends a bounded "Decision record" collapsible from the stored record on republish. First publish precedes first finalize by design; the section rides the next republish and a read failure just omits it.

Verification

• TSC clean; 550 tests green across decision-record/queue/queue-2/lifecycle/migration-collisions, including an end-to-end republish test asserting the collapsible, the clause, and the truncated digest appear in the posted comment body.
• Changed-line coverage: 0 uncovered statements/branches. Branding + schema-drift checks green.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
21829	2	21827	21

View the top 2 failed test(s) by shortest run time

test/unit/config-templates.test.ts > config/examples review templates (#1682) > loopover.full.yml body matches .loopover.yml.example from WHERE IT LIVES onward

Stack Traces | 0.0313s run time

AssertionError: expected '# WHERE IT LIVES (first match wins):\…' to be '# WHERE IT LIVES (first match wins):\…' // Object.is equality

- Expected
+ Received

@@ -91,13 +91,10 @@
  #   off      — the dimension is not evaluated.
  #   advisory — the finding is surfaced (comment/context) but never blocks.
  #   block    — the finding can become a hard `LoopOver Gate` blocker
  #              (always confirmed-contributor-gated).
  gate:
-   # Percent (0-20) of would-auto-close PRs randomly HELD for human adjudication instead of closing --
-   # the randomized holdout behind the unbiased close-precision estimate (#8831). 0/absent disables.
-   # closeAuditHoldoutPct: 5
    # Legacy check-run publish switch (#5355) — despite the name, this does NOT turn the deterministic
    # gate itself on or off. Gate evaluation, comments, labels, audit records, spend, and autonomous
    # merge/close all run identically whether this is true, false, or unset; the per-dimension modes
    # below are what actually configure gate evaluation. `enabled` is only a boolean shorthand for
    # `checkMode` below: true maps to `required`, false maps to `disabled`, and it cannot express

 ❯ test/unit/config-templates.test.ts:39:57

test/unit/selfhost-metrics.test.ts > DEFAULT_METRIC_META completeness (drift guard, 2026-07 fix) > every literal metric name emitted anywhere in src/ has a registered DEFAULT_METRIC_META entry

Stack Traces | 0.216s run time

AssertionError: expected [ Array(1) ] to deeply equal []

- Expected
+ Received

- []
+ [
+   "loopover_close_audit_holdouts_total",
+ ]

 ❯ test/unit/selfhost-metrics.test.ts:385:21

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}