fix: preserve exact review leases and requeue legacy artifacts

[brokemac79]

Summary

Repairs the exact-review publication path that stopped applying durable ClawSweeper comments and labels after the read-only review/publisher split.

• Reserve a durable, source-bound review lease before the read-only Codex pass, and carry that exact tuple into the artifact.
• Let the publisher consume only its matching completed tuple; never weaken a different or active lease.
• Requeue fresh reviews for legacy tuple-less artifacts and verified source drift instead of attempting stale publication.
• Cap exact Codex execution at 45 minutes. With the existing 11-minute review reserve this leaves 64 minutes of the 120-minute reviewer job for checkout/setup and artifact/publication finalizers; it also remains below the queue's 130-minute execution lease and well inside the two-hour durable review-lease verifier.

Incident evidence and causal chain

#592 split exact review generation from publication and made the Codex producer read-only with --skip-start-comment. That left reports without the durable lease tuple which the separated publisher needs to prove it owns the visible review lifecycle.

The current publisher then safely refused to overwrite a live lease, reporting:

live durable review tuple has lease comment <id>, but the local report has no durable lease identity

It recorded skipped_stale_review_comment_sync, publish-event-result failed, and the durable publisher queue retried without producing the expected comments/labels. This is demonstrated in these failed publisher runs:

• https://github.com/openclaw/clawsweeper/actions/runs/29448335652 (openclaw/openclaw#107559)
• https://github.com/openclaw/clawsweeper/actions/runs/29446910902 (openclaw/openclaw#107676)
• https://github.com/openclaw/clawsweeper/actions/runs/29446703281 (openclaw/openclaw#101776)

The live backlog audit recorded 2,310 pending exact reviews with only 12 of 64 active at the sampled point. It does not claim every pending item has this same source action. #610 and #611 address separate queue/per-target publishing concerns; they do not restore the missing report lease tuple.

Related: #592, #610, #611.

Safety and rollout

Codex remains read-only against the target. The short lease-reservation step and the publisher alone receive target-write credentials. A legacy artifact with no tuple is not applied; it is requeued as a fresh exact review. A changed source revision, including one that changes while the apply mutation lease is held, is likewise recorded as skipped_changed_since_review and requeued. This PR does not bulk re-admit all pending rows; that remains a separate guarded recovery task.

Validation

Ran locally:

pnpm run build
pnpm run build:repair
pnpm run lint:src
pnpm run lint:repair
pnpm exec node --test test/apply-label-sync.test.ts          # 21 passing
pnpm exec node --test --test-name-pattern "exact event review hands immutable artifacts to one dedicated publisher" test/sweep-workflow.test.ts
pnpm exec node --test --test-name-pattern "exact event source drift|exact publication consumes|exact issue apply" test/apply-label-sync.test.ts
pnpm exec node --test --test-name-pattern "exact event review hands immutable artifacts to one dedicated publisher|sweep exact event reviews" test/sweep-workflow.test.ts
git diff --check

The focused workflow tests and YAML parse passed after the final 45-minute cap. actionlint is not installed on this host. The aggregate workflow test has unrelated native-Windows baseline failures because WSL's /bin/bash is unavailable; the focused workflow tests above pass.

Codex review surfaced and this patch fixes: legacy/source-drift requeue handling, issue-vs-PR lease comparison, the exact-review timeout/lease verifier bound, job-headroom accounting, and the queue execution-lease bound. Per maintainer instruction, the final review loop was stopped after the last correction, so the post-correction branch review is intentionally not claimed as clean.