fix(signals): validate repository before returning cached burden forecasts

[JSONbored]

Motivation

• Prevent leaking stale or orphaned burden forecast snapshots for repositories that no longer exist or are not registered.
• Ensure cached forecasts are only returned when the canonical repository record is present and authorized.

Description

• In loadOrComputeBurdenForecastResponse validate the repository first with getRepository(env, fullName) and return null when the repo is unknown.
• Use the repository's canonical repo.fullName for the cached getBurdenForecast lookup, response metadata, and all bounded listers used when computing a forecast.
• Add a unit regression test that seeds an orphaned burden_forecasts row and asserts the service does not expose it.
• Adjust the malformed-timestamp unit test to register the repository before inserting the cached forecast so stale-timestamp behavior remains covered.

Testing

• Ran npm test -- test/unit/burden-forecast.test.ts and the unit suite passed.
• Ran npm run typecheck (tsc --noEmit) and type checking completed successfully.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	df2af0a	Commit Preview URL Branch Preview URL	Jun 10 2026, 05:46 AM

[gittensory]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#516 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.