fix(issueReporter): stabilize auto-issue dedup and cooldown logic

[shaun0927]

Problem

Four interacting bugs in src/gep/issueReporter.js combine to defeat the
module's own purpose. The symptoms are already visible on this tracker:
issues #395, #396, #397, and #404 are identical auto-filed duplicates
that the reporter was supposed to suppress.

1. computeErrorKey hashes the occurrence count. It feeds signals
   like recurring_errsig(3x):timeout in API call and
   recurring_errsig(4x):timeout in API call verbatim into SHA-256, so
   the same underlying error produces a different key every emission.
   recentIssueKeys.includes(errorKey) can never match.

2. shouldReport bypasses the minStreak gate when the streak
   signal is absent. extractStreakCount returns 0 when no
   consecutive_failure_streak_N signal is present, and the
   streakCount > 0 && streakCount < minStreak guard short-circuits.
   Users who raise EVOLVER_ISSUE_MIN_STREAK still get early reports.

3. maybeReportIssue resets lastReportedAt on the skip branch.
   When findExistingIssue returns an existing open issue, the code
   logs "skipping duplicate" but still writes
   lastReportedAt: new Date().toISOString(). The cooldown check then
   sees a freshly-bumped timestamp, so as long as the existing open
   issue stays open, no re-report is ever possible.

4. findExistingIssue substring fallback matches unrelated
   titles. The fallback it.title.indexOf(titleSig) !== -1 matches
   any title that merely contains the signature as a substring.

computeErrorKey, extractStreakCount, and extractErrorSignature
were not exported, which is how all three bugs in category (1)–(3)
shipped without test coverage.

Fix

• Normalize the recurring_errsig(Nx): prefix inside computeErrorKey
  (uses the same regex that extractErrorSignature already uses).
• Drop the > 0 precondition from the minStreak gate.
• Preserve the prior lastReportedAt on the skip branch; only
  lastSkippedAt and recentIssueKeys are updated.
• Replace the substring fallback with a prefix check that requires
  both the auto-issue prefix and the same signature.
• Export the three helpers so the regressions can be covered.

Testing

$ node test/issueReporter.test.js

Against main with the new test cases (added in this PR):

TypeError: computeErrorKey is not a function
    at run (/.../test/issueReporter.test.js:84:14)

With this PR applied:

issueReporter.test.js: OK

The three new test cases cover:

• computeErrorKey is stable across (3x), (4x), (5x) prefixes.
• shouldReport(minStreak=5) returns false when the streak signal is
  missing, and true when the streak meets the minimum.
• findExistingIssue does not match a title that contains the search
  signature as an unrelated substring.

Scope

• src/gep/issueReporter.js — 4 focused edits, no behaviour change
  outside the bug paths; module exports gain three helpers (additive).
• test/issueReporter.test.js — three new cases.

No changes to obfuscated modules. No config changes. No new
dependencies.

Follow-ups (not in this PR)

• DEFAULT_REPO = 'autogame-17/capability-evolver' legacy handle —
  separate issue.
• sanitize.js pattern gaps (Slack, JWT, Azure, Discord) — separate
  issue.

[autogame-17]

Thank you for the contribution, @shaun0927. As noted in SECURITY.md and our previous triage on related PRs, EvoMap/evolver is a generated distribution mirror of an internal maintainer branch and cannot accept code PRs directly -- the public tarball carries the release integrity signature that only our release pipeline can produce correctly against the internal maintainer branch.

This specific change has been recorded and will be hand-ported into the internal maintainer branch ahead of the next release, with credit to you. Closing this PR accordingly; the underlying issue will be closed or referenced when the port lands.

If you have more suggestions we welcome them as issues (not PRs) so we can triage without creating merge-path confusion.

[autogame-17]

Hi @shaun0927 — this has shipped in v1.69.10 (release, npm).

Ported:

• computeErrorKey now normalizes the recurring_errsig(Nx): prefix so the key is stable across occurrence counts (was defeating recentIssueKeys dedup)
• shouldReport enforces minStreak even when the consecutive_failure_streak_N signal is absent (prior guard was a no-op in that case)
• findExistingIssue replaces the loose substring fallback with an [Auto] Recurring failure: prefix + startsWith match
• skip branch no longer bumps lastReportedAt, so cooldown is not reset indefinitely while an existing auto-issue stays open
• internals exposed for the three new regression tests you suggested

Same note on attribution: the public mirror is built from an internal maintainer branch, so the commit lands via our release pipeline rather than a direct merge. Credit is noted in the v1.69.10 release notes. Thank you.