feat(review): add .gittensory.yml review.exclude_paths (skip files from AI review)

[JSONbored]

Summary

A CodeRabbit-parity path filter (path_filters): a .gittensory.yml review.exclude_paths list of globs whose matching files are excluded from the AI maintainer review (diff + grounding + RAG) — generated/vendored/lockfiles a maintainer doesn't want reviewed.

review:
  exclude_paths:
    - "*.lock"
    - "pnpm-lock.yaml"
    - "dist/**"
    - "*.generated.ts"

• Config-only — lives in manifest.review, no DB migration / OpenAPI.
• Narrows the AI review ONLY. The gate, slop detector, and secret scan still run on the full unfiltered diff, so excluding a path can never weaken a blocker. Empty (default) / no match ⇒ every file is reviewed (byte-identical).
• Uses the manifest's own matchesManifestPath glob semantics (note: * collapses to .* and crosses slashes, so *.lock matches a top-level lockfile; that's why the examples use *.lock, not **/*.lock).

Changes

• focus-manifest.ts — excludePaths on FocusManifestReviewConfig; parse review.exclude_paths (non-empty strings, trimmed, capped at 50, per-entry warnings) + serialize; resolveReviewPromptOverrides now also returns excludePaths; excludeReviewPaths(files, globs) filters via matchesManifestPath (empty globs ⇒ same array reference — provable no-op).
• processors.ts — resolve excludePaths from the already-cached manifest at the AI-review call site; filter the resolved files inside runAiReviewForAdvisory (pure, no extra fetch) before building the diff/grounding/RAG.

No linked issue — a config-as-code review enhancement in the CodeRabbit-parity series (follows #1347 review.profile, #1350 review.path_instructions).

Scope

• src/ only — config parse + resolver + a pure file filter + threading; no migration/OpenAPI/binding
• No secrets/site/CNAME/lovable; no CHANGELOG

Validation

• npm run test:ci — exit 0; 4343 tests pass
• npm audit --audit-level=moderate — 0 vulnerabilities
• Every changed src line + branch covered (lcov BRDA across focus-manifest.ts, processors.ts) — incl. blank/non-string drop, non-array, cap, the round-trip, and both filter branches (match / empty-globs no-op)
• Tests: parse (trim, drop, warn, cap, round-trip); excludeReviewPaths (filter / no-match / empty); resolveReviewPromptOverrides carries excludePaths

Safety

• Cannot weaken the gate — the gate/slop/secret-scan operate on the unfiltered files; this filter is scoped to the AI review's view only
• Byte-identical default (none configured / no match); capped at 50 globs

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.30%. Comparing base (0ece080) to head (0a27ba8).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1353   +/-   ##
=======================================
  Coverage   95.30%   95.30%           
=======================================
  Files         189      189           
  Lines       20447    20466   +19     
  Branches     7374     7381    +7     
=======================================
+ Hits        19486    19505   +19     
  Misses        378      378           
  Partials      583      583           

Files with missing lines	Coverage Δ
src/queue/processors.ts	87.59% <100.00%> (ø)
src/signals/focus-manifest.ts	97.66% <100.00%> (+0.09%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.