fix(signals): classify bower_components and jspm_packages as vendored

[jeffrey701]

Summary

isVendoredFileFrom recognized node_modules and vendor/third_party dirs, but not bower_components (Bower) or jspm_packages (JSPM) — installed-dependency directories in the same vendored category, not contributor source. Changes under them were miscounted as substantive source effort.

Adds both to the vendored-directory matcher.

Validation

• npx vitest run test/unit/path-matchers.test.ts — green
• npm run typecheck — clean

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.09%. Comparing base (28a6b40) to head (332dc58).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2777   +/-   ##
=======================================
  Coverage   96.09%   96.09%           
=======================================
  Files         245      245           
  Lines       27391    27391           
  Branches     9947     9947           
=======================================
  Hits        26322    26322           
  Misses        443      443           
  Partials      626      626           

Files with missing lines	Coverage Δ
src/signals/path-matchers.ts	88.46% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-03 18:38:28 UTC}

2 files · 1 AI reviewer · no blockers · readiness 73/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This change correctly extends the vendored path matcher to include Bower and JSPM dependency directories, and the existing normalization path means case and Windows separators continue to work through the same helper. The regex remains directory-bound, so it does not broaden matching to filenames that merely contain those names. The added unit coverage verifies the direct matcher, and the production classifier will inherit the behavior because it calls the same internal vendored matcher.

Nits — 3 non-blocking

• nit: test/unit/path-matchers.test.ts:250 should add representative `bower_components/...` and `jspm_packages/...` cases to the `classifyChangedFile` table so the source-effort misclassification path is covered end-to-end, not only through `isVendoredFile`.
• Add classifier-level regression cases in `test/unit/path-matchers.test.ts` for `bower_components/jquery/dist/jquery.js` and `jspm_packages/npm/lodash/index.js` returning `vendored`.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 49 registered-repo PR(s), 24 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	jeffrey701; Gittensor profile; 49 PR(s), 0 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: jeffrey701
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 49 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Explain no-issue PR.
• Await review-lane availability.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.