feat: sync v1.6.7 with Voyage premium retrieval

[100yenadmin]

Summary

• Rebase Electric Sheep GitNexus runtime onto upstream v1.6.7 and set package version to 1.6.7-electric.1 with upstreamBase=v1.6.7.
• Replay the local hardening/custom behavior: read-only MCP mode, repo allowlist/default repo, maxTokens, lifecycle/orphan handling, --skip-ai-context, token-budgeted query output, and release-candidate validation without default publishing.
• Add the gated Voyage premium retrieval profile: Voyage output_dimension support, embedding CLI flags, GITNEXUS_PREMIUM_REPO_ALLOWLIST, and query-time rerank-2.5 support behind env gates.
• Preserve the policy boundary: no broad setup, no registry cleanup, no npm/Docker publish, and no paid embedding rollout in this PR.

Evidence

• Policy artifact: /Volumes/LEXAR/Codex/gitnexus-reconciliation-2026-06-10/voyage-policy-20260614-192204/repo-embedding-policy.csv
• Registered indexes at policy time: 29; policy rows: 39 including missing initial premium candidates.
• Current policy result: no automatic paid Voyage rollout; candidates are review/setup queues only.

Local Validation

• npm run build
• npx vitest run test/unit/http-embedder.test.ts test/unit/voyage-reranker.test.ts test/unit/analyze-config.test.ts test/unit/analyze-embeddings-limit.test.ts test/unit/calltool-dispatch.test.ts test/unit/run-analyze.test.ts test/unit/skip-git-cli.test.ts test/unit/mcp-stdout-sentinel.test.ts test/unit/staleness.test.ts test/unit/u8-redos-resource-exhaustion.test.ts test/unit/call-form.test.ts test/unit/type-env.test.ts test/integration/mcp/server-startup.test.ts test/integration/resolvers/kotlin.test.ts test/integration/cross-file-binding.test.ts --maxWorkers=2
  • 15 test files passed; 982 passed, 1 skipped.
• Direct MCP JSON-RPC smoke against rebuilt dist/cli/index.js mcp in read-only mode:
  • initialize ok
  • tools/list exposed only read-only tools
  • list_repos returned only gitnexus
  • query repo=gitnexus returned structured output
  • stdout stray bytes: 0

Safety Notes

• Bounded secret scan found no provided license-shaped value in repo/evidence/config/history targets. It did find expected placeholder/test strings such as your-key and test-rerank-key.
• No registry cleanup, worktree deletion, broad reindex, npm publish, Docker publish, or paid production embedding job was run.

Summary by CodeRabbit

• New Features
  • Added web UI internationalization with a language switcher.
  • Added additional graph visualization modes (force/tree/circles) in the web interface.
  • Added DeepSeek as an LLM provider.
  • Implemented Claude Code PR review swarm (seven persona lanes with a correction gate).
  • Updated web server to optionally inject backend configuration into pages when a backend URL is provided.
• Improvements
  • Refreshed Cursor and GitNexus skill/workflow documentation with streamlined tool names and updated runner guidance.
• Chores
  • Updated development tooling, CI checks, and dependency/tooling versions.

Final blocker-fix pass

• Upstream base: v1.6.7; Electric Sheep fork version: 1.6.7-electric.1.
• Final fix head: 5ead5756.
• Preserves local custom behavior: read-only MCP mode, repo allowlist/default repo, maxTokens, lifecycle/orphan handling, no-publish release validation, --skip-ai-context, Voyage output_dimension, premium repo gating, and rerank behind env gates.
• Documents the large diff as upstream v1.6.7 sync plus targeted Electric Sheep hardening; no registry cleanup, worktree deletion, npm/Docker publish, or production embedding rollout is included.

Closes #12.
Closes #13.
Closes #14.
Closes #15.
Closes #16.
Closes #17.
Closes #18.