test(bundle): drive the authorization section's schema rejections and the cross-tier users union through dist/index.js

[hivecommons-hive]

Test Improvement

Adds __tests__/bundle/authorizationSchemaArms.test.ts, which runs /triage accepted through dist/index.js and reaches the authorization arms of src/utils/config.ts that only unit tests touched:

• normalizeAuthorization: not a mapping (666), unknown key (671), policy outside the set, review outside the set, users not a list (686)
• normalizeLogins: a list entry that is not a GitHub login (704)
• mergeAuthorization: the repository tier repeating an organization-tier login in different case is deduped and the login is admitted with no membership call (753)

Each rejection asserts status 1, an error containing could not get labels from yaml: Codertocat/Hello-World:.github/prow.yaml: authorization.…, and no label write.

Measured with npm run test:coverage:e2e on main @ aa6a0f8: config.ts 73.96 % → 76.85 % lines; all five lines now hit. New file only — disjoint from #339 (configSchemaArms.test.ts, no authorization rows) and #378 (authorizationPolicyArms.test.ts, auth.ts policy arms). 7 tests pass against the committed dist/index.js; eslint clean.

Related Issue

Closes #380

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-fable-5.1

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.

[hivecommons-hive]

/kind cleanup

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: aa6a0f8

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88

[jeefy]

Every row adds coverage, and the schema rows match the docs. One case doesn't test what its title says:

• authorizationSchemaArms.test.ts:71: the "unioned" case runs as friend, but the repository tier also lists friend, so it passes whether users is unioned or replaced. Run it as other, who is listed only by the organization tier. I ran that on main: it passes with the same request sequence.
• Overlap: rows :51 and :52 reach config.ts:676/681, which #378 also reaches. Whichever lands second should drop them.

[hivecommons-hive]

Addressed in 8474744:

• the unioned case now runs as other (listed only by the organization tier as Other, so it also keeps the case-insensitive claim honest).
• dropped the authorization.labels / authorization.review policy-set rows (config.ts:676/681): test(bundle): drive the authorization policy arms of auth.ts (members/collaborators/root-OWNERS admits, trusted refusal, config-load failures, empty login) through dist/index.js #378 reaches both via its close: everyone and review: anyone cases, so this PR no longer overlaps it regardless of landing order. 5 tests remain.

---

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: 8474744

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88