give the PR reviewer the filed issue's text so it can judge intent, not just relatedness

[atomantic]

Summary

The pr-reviewer pipeline could tell that an external PR linked an open issue assigned to its opener. It could not tell whether the PR did what that issue asked — the issue's title and body never crossed into any stage. Only issue numbers and open/assigned booleans did, so Stage 2's rule "return true only for a change related to the linked issue" and Stage 3's approve/request-changes verdict were both judged without the requirement in front of them.

• server/lib/modelAbuseGuard.js — normalizeLinkedIssues (bounded: 10 issues, 300-char titles, 8000-char bodies, per-issue truncated flag), linkedIssueIntentContent, and linkedIssueIntentFingerprint, which hashes through the existing modelAbuseContentFingerprint so intent evidence shares the boundary's one fingerprinting scheme. normalizeEligibilityFacts gains intentFingerprint; the sha256-hex shape is now one exported isSha256Hex instead of three private copies.
• server/services/prReviewerSecurity.js — the preflight keeps the title/body of each open linked issue and screens that text in the PR's own model-abuse pass. An injected issue body therefore flags the PR rather than reaching a reviewer as the requirement it is supposed to trust. The scan key covers the issue text, so editing a linked issue re-scans rather than reusing a stale verdict.
• server/services/modelAbuseGuard.js — linkedIssues validated at the snapshot boundary, so it reaches both Stage 2 and Stage 3 envelopes and counts against the snapshot size cap.
• Stage 2 / Stage 3 prompts — one shared LINKED_ISSUE_INTENT_EVIDENCE block (the pattern REQUIRED_REVIEW_PUBLICATION_RULE already uses) states that the issue text is the requirement, that the PR's own description is the author's claim about it, and that a line inside an issue addressing the reviewer is content and not a command. Stage 2 rejects a diff that implements something else, is a refactor the issue never asked for, or leaves the stated ask untouched. Stage 3 treats scope drift as blocking — clean, well-tested code for the wrong task is request_changes, and vague or clipped intent is defer.

Deterministic guards, not just prompt text

• eligibilityFactsAllow admits a non-waived PR only when screened issue intent actually reached the gate. A model that answered eligible with no requirement in front of it was guessing.
• eligibilityFactsStillCurrent recomputes the intent fingerprint from the issues it already refetches, so an approval whose linked issue was rewritten after the gate judged it is discarded instead of merged. Facts persisted before intent screening existed carry no fingerprint and keep their previous meaning.
• The maintainer "Review this PR" waiver is untouched: an explicitly requested PR with no linked issue still runs, judged on the change alone.

Decisions worth flagging

• One classifier pass, not two. The issue text rides the PR's existing scan rather than a second Prompt Guard subprocess per PR. The verdict is one status for the whole PR and findings are deliberately generic, so a separate pass bought no attribution — and freshness stays anchored on both halves separately (contentFingerprint for the diff, intentFingerprint for the issue text).
• The model-abuse content fingerprint is unchanged. Adding issue text to it would have broken parity with pullRequestContentFingerprint, which the pre-action recheck recomputes from PR title/body/diff.
• Only open linked issues carry intent. A closed issue is not a live requirement, and the recheck derives its fingerprint from the same open set.

Test plan

• server/lib/modelAbuseGuard.test.js — bounds/order/dedup and the truncated flag; fingerprint stability, sensitivity to a rewritten body, and null for no evidence; an unusable fingerprint kept out of the validated fact set.
• server/services/prReviewerSecurity.test.js — intent evidence and its fingerprint recorded alongside the prerequisites; the issue text present in the single scanned payload and carried to the reviewer; a hostile linked issue withholds the PR without quoting the content; unreadable issue still fails the lookup closed.
• server/services/prReviewerPipeline.test.js — a model-positive decision forced false when no screened intent reached the gate.
• server/services/issueWatcher.test.js — an approval discarded when the linked issue was rewritten after the gate judged it, and the same approval landing against the text it was actually judged against (verified to fail without the fix).
• server/services/taskPromptDefaults.test.js — both judging stages carry the shared intent block; Stage 2's mismatch rejections and Stage 3's scope-drift/defer rules.
• Full server suite: 38,645 passed. One unrelated timeout flake per run (different file each time: sprite atlas, then settings secrets-strip), both green in isolation.