fix(agent): respect dry-run for tracker auto-apply

[JSONbored]

Motivation

• Auto-apply mode previously performed GitHub milestone/Projects v2 mutations using a hard-coded "live" Octokit, bypassing per-repo agentPaused/agentDryRun/global-freeze write suppression and audit semantics.
• Thread the resolved repo action mode into the auto-apply path so pause/dry-run/freeze controls and the existing makeInstallationOctokit suppression hook apply to autonomous metadata writes.

Description

• Thread AgentActionMode into the project-tracker adapter API and pass it to attach calls so adapters create Octokit clients with the repository's effective action mode instead of always using "live" (src/integrations/project-tracker-adapter.ts).
• Add an actionMode parameter to maybeAutoApplyProjectOrMilestoneMatch and propagate the resolved mode from the webhook entry point maybeSuggestMilestoneMatchForPr (src/integrations/project-tracker-adapter.ts).
• Resolve and pass actionMode at the PR webhook call site using resolveRepoActionMode(env, settings) so per-repo/global pause and dry-run are respected (src/queue/processors.ts).
• Add a regression unit test that verifies auto-applied milestone writes are suppressed in dry_run and that github.write.suppressed audit rows are recorded (test/unit/project-tracker-adapter.test.ts).
• Regenerate Cloudflare worker runtime types after cf-typegen drift check (worker-configuration.d.ts).

Testing

• Ran the focused unit suite with npx vitest run test/unit/project-tracker-adapter.test.ts and the updated tests passed.
• Ran npm run typecheck and npm run cf-typegen:check and both completed successfully.
• Started the full local gate via npm run test:ci; it progressed through lint/migration/schema/selfhost/cf-typegen/typecheck and much of coverage, but was stopped after the coverage run exposed unrelated existing failures in test/unit/queue-5.test.ts and test/integration/api.test.ts (these failures are outside the scope of this change).
• npm audit --audit-level=moderate could not complete in this environment (npm audit endpoint returned HTTP 403).

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.34%. Comparing base (b81e00c) to head (2d81f9f).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5207   +/-   ##
=======================================
  Coverage   94.34%   94.34%           
=======================================
  Files         473      473           
  Lines       39973    39976    +3     
  Branches    14573    14574    +1     
=======================================
+ Hits        37712    37715    +3     
  Misses       1585     1585           
  Partials      676      676           

Flag	Coverage Δ
shard-1	46.34% <0.00%> (-0.13%)	⬇️
shard-2	34.41% <0.00%> (-0.14%)	⬇️
shard-3	30.82% <100.00%> (-0.12%)	⬇️
shard-4	33.28% <0.00%> (-0.03%)	⬇️
shard-5	33.52% <0.00%> (-0.17%)	⬇️
shard-6	45.17% <0.00%> (+0.30%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/integrations/project-tracker-adapter.ts	100.00% <100.00%> (ø)
src/queue/processors.ts	95.51% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.