test(bundle): drive the pull-request OWNERS fail-closed arm (auth.ts:426, no OWNERS file covers README.md) through dist/index.js

[hivecommons-hive]

Description

Adds __tests__/bundle/ownersUncoveredFile.test.ts (new file only; imports helpersFor, repo, token from ./helpers and prCommentEvent, pullBody from ../utils/ownersFixtures) with one /lgtm case driven through the committed dist/index.js against fakeGithub — the fail-closed arm of assertPullRequestOwner in src/utils/auth.ts (:426, no OWNERS file covers ${file}) that no bundle test reached:

• base tree carries only sdk/OWNERS (approvers: [bob]); the pull request changes sdk/x.go and README.md; bob comments /lgtm
• asserts exit 1, the refusal comment and ::error name README.md, no POST /issues/1/labels, and — because the tree does have OWNERS files — no GET /contents/OWNERS root fallback and no /orgs/*/members or /collaborators probe

Measured with npm run test:coverage:e2e on main @ aa6a0f8: src/utils/auth.ts:426 goes from DA:426,0 to DA:426,1. Per the review on #283, the test pins only the message fragment (not the because Error: wrapper) and asserts no fixed order among the concurrent OWNERS reads.

Disjoint from the open bundle PRs: #283 (ownersAuth.test.ts) drives the neighbouring :433 arm and leaves the remaining throw arms out by its own description; #355 drives :432 on /approve; #320/#328/#331/#365/#369/#383 cover owners.ts, pullRequestOwners.ts and the issue-side fallback. After merging all 38 open held heads, :426 was still the only unreached line of this function.

Closes #400

Testing

• npx vitest run __tests__/bundle/ownersUncoveredFile.test.ts — 1/1 passes, 10/10 repeated runs green
• npx eslint __tests__/bundle/ownersUncoveredFile.test.ts — clean
• npm run test:coverage:e2e on this file alone — auth.ts DA:426,1

Checklist

• I ran npm run all to lint and build my code — lint run on the new file; no source touched
• I ran npm run pack and committed dist/ — not applicable, dist/ unchanged
• Commits are signed off (DCO)
• Note any new dependencies these changes bring in — none
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation — none needed
• My changes generates no new warnings

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

/kind cleanup

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 9beaa55

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88