fix: review hardening — full push-range diff, fail-closed diff fetch, crash-safe queue, 403 self-heal

- push reviews now fetch ONE compare diff (before...after) instead of
  slicing to the first 20 commits under a head-sha status; new-branch
  pushes (zero before-sha) fall back to the head commit diff
- truncated diffs can no longer yield a clean pass: verdict capped at
  warn and status description prefixed 'partial review (diff truncated)'
- any diff-fetch failure (throw / empty body on a non-empty push or PR)
  short-circuits to status 'warning' ('review unavailable — diff fetch
  failed (not blocking)') with a ledger row; a diffless prompt is never
  sent to the model
- accepted jobs persist to sqlite (queue_jobs) before the pending status
  posts; startup re-enqueues rows that never reached a final state, so
  restarts no longer strand shas at 'pending'
- 403 on status/comment posts self-heals: admin-scoped token (config
  admin_token) adds shre-reviewer as collaborator (write), retries once
- scripts/wire-repos.mjs: idempotent estate-wide webhook + collaborator
  wiring over GET /repos/search
- tests: 32 -> 51 (truncation cap, persisted-queue reconciliation,
  collab-retry stubs, fetchDiff routing)

Co-Authored-By: Claude Fable 5 <[email protected]>

src/lib/access.js

@@ -0,0 +1,19 @@
+// Self-healing bot access: new repos wired by the admin default hook 403 the
+// bot's status/comment posts because shre-reviewer is not a collaborator yet.
+// On a 403 we add the bot as collaborator (write) using the admin-scoped
+// token, then retry the original call exactly once.
+
+export async function withCollabRetry(fn, { adminGitea, owner, repo, botUsername, log }) {
+  try {
+    return await fn();
+  } catch (e) {
+    if (e?.status !== 403) throw e;
+    if (!adminGitea) {
+      log?.(`[${owner}/${repo}] 403 from forge and no admin_token configured — cannot self-heal collaborator access`);
+      throw e;
+    }
+    log?.(`[${owner}/${repo}] 403 from forge — adding ${botUsername} as collaborator (write) and retrying once`);
+    await adminGitea.addCollaborator(owner, repo, botUsername, 'write');
+    return fn();
+  }
+}