feat(review): add .gittensory.yml review.path_instructions (per-path AI review rules)

[JSONbored]

Summary

The second CodeRabbit-parity feature: a .gittensory.yml review.path_instructions list that lets a maintainer attach per-path natural-language guidance, which the AI maintainer reviewer applies when a PR's changed files match the glob.

review:
  path_instructions:
    - path: "src/**"
      instructions: "Enforce strict null checks and explicit error handling."
    - path: "tests/**"
      instructions: "Cover both sides of every conditional."

• Config-only — lives in manifest.review (.gittensory.yml config-as-code), no DB migration / OpenAPI.
• Presentation only — guides the advisory write-up; never changes the gate verdict. No match / none configured ⇒ the reviewer prompt is byte-identical to today.

Changes

• focus-manifest.ts — ReviewPathInstruction type + pathInstructions on FocusManifestReviewConfig; parse (path required + trimmed, instructions required + public-safe, capped at 50, per-entry warnings) + serialize; resolveReviewPathInstructions(entries, changedPaths) → the applicable prompt section using the manifest's own matchesManifestPath glob semantics; resolveReviewPromptOverrides(manifest) centralizes the null-manifest defaults for profile + path-instructions.
• ai-review.ts — pathGuidance on the input; buildSystemPrompt appends it.
• processors.ts — resolve overrides from the already-cached manifest at the AI-review call site; the per-PR glob match happens inside runAiReviewForAdvisory (pure, no extra fetch).

Closes #1345

Scope

• src/ only — config parse + resolver + prompt suffix + threading; no migration/OpenAPI/binding (ui:openapi:check green)
• No secrets/site/CNAME/lovable; no CHANGELOG — instructions pass the manifest public-safe filter at parse time

Validation

• npm run test:ci — exit 0; 4319 tests pass
• npm audit --audit-level=moderate — 0 vulnerabilities
• Every changed src line + branch covered (lcov BRDA across focus-manifest.ts, ai-review.ts, processors.ts) — incl. non-string path, missing instructions, non-public-safe, non-array, cap, and the null-manifest default
• Tests: parse (drop invalid/unsafe + warn), round-trip, cap; resolveReviewPathInstructions (match / no-match / empty); resolveReviewPromptOverrides (null + non-null); buildSystemPrompt appends/omits pathGuidance

Safety

• Presentation knob only — cannot affect the gate verdict, disposition, or the public-safe boundary (instructions are public-safe-filtered at parse)
• Byte-identical default (none configured / no match); capped at 50 entries so a manifest can't bloat the prompt

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.28%. Comparing base (cc8dc3f) to head (abfd8bb).
⚠️ Report is 2 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1350   +/-   ##
=======================================
  Coverage   95.27%   95.28%           
=======================================
  Files         188      188           
  Lines       20336    20373   +37     
  Branches     7327     7340   +13     
=======================================
+ Hits        19375    19412   +37     
  Misses        378      378           
  Partials      583      583           

Files with missing lines	Coverage Δ
src/queue/processors.ts	87.59% <100.00%> (+0.02%)	⬆️
src/services/ai-review.ts	97.71% <100.00%> (+0.01%)	⬆️
src/signals/focus-manifest.ts	97.57% <100.00%> (+0.19%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.