feat(calibration): per-repo loosening loop — repos earn overrides on their own evidence

[JSONbored]

Summary

Closes #8217.

Adds the per-repo apply path on top of #8216's override precedence: repos whose own signal history is dense enough now earn repo-scoped overrides from their own evidence, instead of inheriting only the global knob.

• runPerRepoKnobLoosening(env, knob): slices the trailing 90-day corpus by repo (sliceCorpusByRepo, contributor calibration: pure per-repo corpus slicing + density stats #8215), checks per-repo density eligibility (computeRepoCorpusDensity), and evaluates evaluateKnobLoosening on each eligible repo's own slice with the knob's unchanged split discipline.
• Bounded work per tick: at most PER_REPO_LOOSENING_MAX_REPOS_PER_TICK (10) repos, resumed via a rotating per_repo_loosening_cursor:<knobId> system flag, so a large install never starves the dispatch tick.
• Applies write the repo-scoped key (<overrideFlagKey>:repo:<owner/repo>) that calibration: per-repo knob overrides — storage scheme, resolution seam, and full settings wiring #8216's getKnobOverrideForRepo already consumes, with the same non-best-effort write + one structured alert per applied step, metadata.scope: "repo".
• loadKnobStatus now reports repoOverrides so the knobs endpoint shows every earned repo override beside the global state.
• Wired into the calibration tick after the global loop, double-gated by each knob's own autotune env var.

Validation

• Full local gate npm run test:ci green (TEST_CI_EXIT=0), plus npm audit --audit-level=moderate.
• Rebased onto current main (import-union conflict with the feat(calibration): reliability curves beside the ladder — knobs status + advisor surfacing #8262 reliability-curve merge resolved); post-rebase tsc --incremental false clean and the affected suites (knob-loosening-run, job-dispatch) pass 31/31.
• 100% line+branch coverage on every changed range: density-ineligible repos, cursor rotation wraparound, apply refusal arms, and the empty-corpus fallbacks each have both sides exercised.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.63%. Comparing base (904ec7d) to head (d615317).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8264      +/-   ##
==========================================
- Coverage   92.15%   91.63%   -0.53%     
==========================================
  Files         786      786              
  Lines       78814    78860      +46     
  Branches    23790    23800      +10     
==========================================
- Hits        72630    72261     -369     
- Misses       5062     5524     +462     
+ Partials     1122     1075      -47     

Flag	Coverage Δ
shard-1	53.35% <100.00%> (-0.51%)	⬇️
shard-2	49.47% <4.25%> (-0.80%)	⬇️
shard-3	56.66% <4.25%> (-0.64%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/queue/job-dispatch.ts	99.32% <100.00%> (+<0.01%)	⬆️
src/services/knob-loosening-run.ts	100.00% <100.00%> (ø)

... and 3 files with indirect coverage changes