fix(observability): surface publish/checks-perm/secret-scan failures to Sentry

[JSONbored]

Summary

Surfaces three review-pipeline failure classes in processors.ts to Sentry. The self-host forwarder (src/selfhost/sentry.ts) only forwards level:"error"/"fatal" console lines, so these were invisible to operators:

1. Total public-surface publish failure (maybePublishPrPublicSurface, the publishedOutputs.length === 0 && failedOutputs.length > 0 branch): the advisory ran but nothing reached the PR (revoked token / perms removed / GitHub 5xx) — the worst failure for an advisory-only bot — was recorded only to the DB audit ledger. Now escalated via captureReviewFailure(..., { kind:"publish", owner, repo, pr, head_sha, failedOutputs }) (already imported; no-op when Sentry is off). Scoped to the total-failure branch (a partial publish stays ledger-only to avoid noise).
2. Install-wide Checks:write gap (auditGateCheckPermissionMissing chokepoint + the context check-run branch): a common self-host misconfig silently prevents the required gate check-run from ever posting on any PR — now logged at level:"error" (gate_check_permission_missing / check_run_permission_missing). Volume bounded (once-per-install config fault).
3. Secret-leak scan crash (maybeAddSecretLeakFinding catch): a crashed credential scanner degraded silently to "no finding" at level:"warn" — flipped to level:"error" (a security-observability event).

Surfaced by the 2026-06-27 review-pipeline hardening audit (observability — high + medium).

Scope

• Conventional Commit title; focused (one src file + its test).
• No site//CNAME/Pages; follows CONTRIBUTING.md.
• Small self-evident extension of the fix(observability): capture AI-CLI stderr + surface exhausted provider failures to Sentry #1605/fix(observability): surface RAG/enrichment/inline review failures to Sentry (#1618) #1619 Sentry-instrumentation line.

Validation

• git diff --check · actionlint · typecheck
• test:coverage — all three branches are exercised by existing tests (pr_public_surface_failed, gate_check_permission_missing, check_run_permission_missing); the new log/capture lines add no branches. Added a captureReviewFailure spy to the existing total-failure test pinning the kind:"publish" escalation. The secret-scan catch is /* v8 ignore */.
• test:workers · build:mcp · test:mcp-pack · ui:* · npm audit --audit-level=moderate

If any required check was skipped, explain why:

• No migration/OpenAPI/cf-typegen: logging/escalation only.

Safety

• No secrets/wallets/trust-scores exposed — logs carry repo/PR/SHA + bounded fields.
• No public GitHub text change · auth/CORS N/A.

Notes

• Self-host engine code; ships on the next engine rebuild. captureReviewFailure is a no-op on cloud/Workers and on self-host without a Sentry DSN.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.52%. Comparing base (0cf3b30) to head (f064c6e).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1627   +/-   ##
=======================================
  Coverage   95.52%   95.52%           
=======================================
  Files         204      204           
  Lines       22056    22060    +4     
  Branches     7967     7967           
=======================================
+ Hits        21069    21073    +4     
  Misses        412      412           
  Partials      575      575           

Files with missing lines	Coverage Δ
src/queue/processors.ts	88.32% <100.00%> (+0.03%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.