fix: dedupe llm repo resolution jobs on the lowercased purl type

[mbani01]

Summary

• The purl type is lowercased before choosing the collection path and before looking up an existing job, so pkg:Hackage/aeson and pkg:hackage/aeson now share one LLM repo resolution job and the second submission gets the 409 instead of a second paid LLM call. Follow-up to feat: resolve member contributors for unknown ecosystems via llm repo inference #5000 (Bugbot finding that landed after the squash merge).
• The poll endpoint's OpenAPI failed schema now describes the Job result expired, resubmit the job reason inferred-repo jobs return once their result has left Temporal retention, so Akrites can match on it.

Refs linuxfoundation/lfx-cdp-insights-ops#502

[cursor]

PR Summary

Low Risk
Scoped to inferred-repo job submission deduplication and API documentation; no change to tracked-ecosystem GitHub collection paths beyond new tests.

Overview
LLM inferred-repo member-contributors jobs now normalize the PURL by lowercasing only the type segment (canonicalizePurlType) before active/latest job lookups and when persisting the job. Submissions like pkg:Hackage/aeson and pkg:hackage/aeson dedupe to one job and reuse 409/active-job behavior instead of starting duplicate LLM resolution workflows.

The Akrites OpenAPI schema for member-contributors poll failed.reason documents the Job result expired, resubmit the job string for inferred-repo jobs after Temporal retention, so clients can treat that as a signal to resubmit the same PURL.

^{Reviewed by Cursor Bugbot for commit 04962fb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

🟡 Changes recommended

Existing mixed-case job keys remain unmatched after deployment, allowing duplicate paid workflows.

1 open finding

• Case normalization misses existing jobs, causing duplicate paid workflows · New

What changed in this PR

This PR normalizes purl types when submitting inferred-repository contributor jobs, aiming to prevent duplicate paid LLM calls.

Changes:

• Canonicalizes inferred-job purls before lookup and creation.
• Adds normalization tests and lookup assertions.
• Documents the expired-result response in OpenAPI.

File	Description
backend/​src/​api/​public/​v1/​packages/​submitMemberContributorsJob.ts	Normalizes inferred-job keys.
backend/​src/​api/​public/​v1/​packages/​submitMemberContributorsJob.test.ts	Verifies canonical lookup and creation keys.
backend/​src/​api/​public/​v1/​packages/​memberContributorCollectionPaths.ts	Adds type-only purl normalization.
backend/​src/​api/​public/​v1/​packages/​memberContributorCollectionPaths.test.ts	Tests normalization while preserving package-name case.
backend/​src/​api/​public/​v1/​akrites-external/​openapi.yaml	Documents expired inferred-job results.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mbani01]

Not reachable with the data that exists. The table holds 4 jobs in prod (2 github, 2 llm_repo_resolution, created today) and none has a mixed-case purl type, so no stored key is orphaned by this change. Had one existed the cost would be a single extra LLM call (~$0.002) after which the lowercased row becomes the one every later lookup hits; a migration for that is not worth the risk. Leaving as is.