fix(github): allow self-host TRUSTED_SCANNER_BOT_LOGINS override

[JSONbored]

Summary

• isTrustedScannerReviewThreadAuthor (src/github/backfill.ts) only recognized four hardcoded scanner bot logins (superagent[bot], superagent-security[bot], superagent-security-dev[bot], brin[bot]), so a self-hoster running a different third-party scanner (CodeQL, Snyk, Semgrep, SonarCloud, DeepSource, etc.) had that scanner's unresolved review-thread comments silently fall through every trust check and never create a review_thread_unresolved gate blocker.
• Adds an additive TRUSTED_SCANNER_BOT_LOGINS env var (comma-separated logins, merged with the built-in defaults — same shape as resolveDriftAssignees in src/upstream/ruleset.ts), so a self-hoster can trust their own scanner bot without a source edit while the four built-in defaults stay recognized unless the operator lists more.
• Checked npm run selfhost:env-reference: src/github/backfill.ts is not in the generator's DEFAULT_SOURCE_ROOTS, so no change was produced for this new env var — the generated doc's scope did not need updating for this change.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• This is a backend-only, single-file change (src/github/backfill.ts) with no UI/MCP/workflow/dependency surface, so ui:*, build:mcp/test:mcp-pack, test:workers, actionlint, and npm audit were not run locally — CI covers them and none of these surfaces were touched. test:coverage was run scoped to test/unit/backfill.test.ts with coverage restricted to src/github/backfill.ts (not the full unsharded suite); the lcov output confirms 100% line and branch coverage on every line this PR changes (src/github/backfill.ts:3800, 3846-3865).

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (N/A — no auth/cookie/CORS/session surface touched; new tests cover the trust-check's negative paths: unconfigured scanner, whitespace-only override.)
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs. (No changelog edit; no visible-doc change required — see Summary note on selfhost:env-reference.)

UI Evidence

N/A — backend-only change, no UI surface.

Notes

• Fixes Make trusted-scanner-bot allowlist configurable #4614

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.12%. Comparing base (450e314) to head (c3cbcad).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4661   +/-   ##
=======================================
  Coverage   94.12%   94.12%           
=======================================
  Files         434      434           
  Lines       38496    38503    +7     
  Branches    14038    14040    +2     
=======================================
+ Hits        36233    36240    +7     
  Misses       1604     1604           
  Partials      659      659           

Files with missing lines	Coverage Δ
src/github/backfill.ts	97.18% <100.00%> (+0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.