fix(gate): block untested-data-access via the shared policy engine

[veksen]

Goal

The CI⇄MCP verdict loop (Query-Doctor/Site epic #3493) wants each condition's pass/fail to come from the shared taxonomy and policy, not each surface's own severity. This PR makes the analyzer's test-presence gate stop deciding its own severity and adopt @query-doctor/core's taxonomy + policy engine. Closes Query-Doctor/Site#3541.

What

Before: a PR that changed data-access code with no related real-DB test got a "Warning" callout and a green check. A warning beside a passing check is invisible to downstream reviewers — human or agent — who key on the check status, so the finding was silently dropped (documented on a live PR in the issue thread).

After: the same PR gets a failing check by default. The comment block loses its "Warning" heading — it renders [!CAUTION] when blocking, framed as "could not verify", never "your query is broken". A repo can soften the gate to non-blocking (warn → [!NOTE], neutral) or suppress it (off); those are config, not the default. Adding a real-DB test or triaging the flagged queries and re-running still goes green, unchanged.

How

Read in this order:

• src/gate/policy.ts (new) — resolveVerdict maps a gate verdict to its CI conclusion via core's conclusionForVerdict (taxonomy #3498) + policyFor (policy #3500). uncertain-conservative-flag concludes failure; warn caps that at a surfaced-but-non-blocking neutral; off reports the condition as unsurfaced.
• src/main.ts — resolves the verdict before posting the report (so off also drops the comment block and the comment can render the right framing), then carries the conclusion into the check: core.setFailed on failure, core.warning on neutral. Replaces the old always-core.warning path.
• src/reporters/github/success.md.j2 — drops [!WARNING]; an inline conditional picks [!CAUTION] (blocking) or [!NOTE] (softened) from the resolved conclusion, kept on one line so the GitHub callout stays contiguous.
• src/config.ts / src/reporters/reporter.ts — AnalyzerConfig.conditionPolicies (optional) carries per-repo overrides; ReportContext.testPresenceConclusion drives the comment framing.

Note: conditionPolicies is read from the repo config ("conditionPolicies" in config) and is empty until Site adds it to RepoConfig/getRepoConfig — an additive, non-breaking follow-up. Until then every repo gets the safe default (fail); the gate honours an override the moment it arrives.

Scope note: this keeps the analyzer's inline TestPresenceVerdict (a precursor to the full CiVerdict contract #3497) rather than migrating to it, so the change stays surgical. It uses the two functions the issue names directly rather than evaluateRun, which would require the full contract.

Tests

• src/gate/policy.test.ts (new) — resolveVerdict: blocks by default (fail→failure), softens under warn (→neutral, surfaced), suppresses under off (unsurfaced), and keeps a pass verdict green even under fail (proving the taxonomy, not a blanket fail, drives it).
• src/reporters/github/github.test.ts — the block renders [!CAUTION] for a blocking verdict and [!NOTE] for a softened one, and never [!WARNING].
• Full suite green: 311 passed (30 files). Typecheck clean, build succeeds.

[github-actions]

Query Doctor Analysis

3 queries analyzed

0 regressed · 0 improved · 0 new · 0 removed

2 pre-existing issues

• SELECT "guests"."id", "guests"."session_id", "guests"."username", "guests"."avatar_path", "guests"."color", "guests"."side", "guests"."audio_recording_path", "guests"."audio_recording_public", "gue...
  index assets(event_id, inserted_at desc)
  cost 31,003,449 → 1,498 (100% reduction)
• SELECT * FROM guest_ip_addresses WHERE ip_address = '127.0.0.1';
  index guest_ip_addresses(ip_address)
  cost 154,402 → 8 (100% reduction)

_{Using assumed statistics (10000000 rows/table). For better results, sync production stats.}

_{More detail → get_ci_run({ runId: "019f6e83-7bd6-77c5-aa11-6176a13ed686" }) · view run · docs}