fix(miner-governor): require global live opt-in

[JSONbored]

Motivation

• Close a safety gap where a repository's .gittensory-miner.yml execution.liveModeOptIn: "live" could enable real miner writes without the operator explicitly opting the miner into live mode.
• Align runtime behavior with the documented/type-level safety boundary that the operator must opt in globally and the repo must opt in on its side before live writes execute.

Description

• Require both operator global opt-in and repo manifest opt-in for live mode by changing the resolver from an OR to an AND (resolveMinerActionMode now requires globalLiveModeOptIn && repoLiveModeOptIn === "live").
• Update comments and the miner wrapper (packages/gittensory-miner/lib/governor-action-mode.js) to document that the repo field is an allowance, not a standalone authorization.
• Update tests in packages/gittensory-engine and packages/gittensory-miner to assert that repo-only and global-only opt-ins remain dry_run and that both opt-ins are required for live execution.
• Regenerate Cloudflare worker runtime types (worker-configuration.d.ts) to satisfy local drift checks.

Testing

• Ran npm --workspace @jsonbored/gittensory-engine run build and the engine build succeeded.
• Ran the engine unit suite (npm run test --workspace @jsonbored/gittensory-engine) and targeted vitest files (npx vitest run test/unit/miner-governor-action-mode.test.ts test/unit/miner-governor-chokepoint.test.ts) and they passed.
• Ran npm run cf-typegen which regenerated worker-configuration.d.ts successfully.
• Attempted the full local gate npm run test:ci but it encountered unrelated long-running/timeout failures in other integration/queue/backfill tests and network-dependent actionlint setup issues, so the full gate was not completed here; npm audit --audit-level=moderate also failed with a registry 403 during the audit step.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	4e26f78	Commit Preview URL Branch Preview URL	Jul 12 2026, 10:08 AM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.34%. Comparing base (2e9fab7) to head (4e26f78).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5231   +/-   ##
=======================================
  Coverage   94.34%   94.34%           
=======================================
  Files         473      473           
  Lines       39968    39968           
  Branches    14570    14570           
=======================================
  Hits        37708    37708           
  Misses       1585     1585           
  Partials      675      675           

Flag	Coverage Δ
shard-1	46.42% <100.00%> (ø)
shard-2	34.47% <100.00%> (ø)
shard-3	30.97% <0.00%> (ø)
shard-4	33.31% <0.00%> (+<0.01%)	⬆️
shard-5	33.69% <100.00%> (ø)
shard-6	44.88% <0.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...ages/gittensory-engine/src/governor/action-mode.ts	90.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.