test(authz): pin cross-issue ancestry behavior (BLO-18797)

[allyblockcast]

Thinking Path

• Paperclip authorization tests guard who can act on issues and issue comments.
• BLO-18797 AC fix(ccrotate-tier-gate): pick Claude base account by utilization headroom #5 depends on cross-issue ancestry behavior staying explicit.
• Prior regressions around descendant and sibling issue relationships can silently broaden access if only the happy path is tested.
• Normal issue comments should follow the target issue's ownership and grants, not inferred ancestry from a related issue.
• This PR adds focused regression coverage so future authz changes fail loudly if that boundary moves.

Linked Issues or Issue Description

• Refs BLO-18797 AC fix(ccrotate-tier-gate): pick Claude base account by utilization headroom #5.
• Related authorization regression cases: BLO-19170 and BLO-19036.
• Duplicate search: checked open Paperclip PRs for BLO-18797/authz regression coverage; no duplicate ready PR was found.

What Changed

• Added the missing BLO-19170 descendant authorization regression.
• Added the load-bearing BLO-19036 sibling authorization regression.
• Pinned that normal issue comment authorization follows target ownership/grants, not ancestry.

Verification

• pnpm --filter @paperclipai/server test -- server/src/__tests__/authorization-service.test.ts (76/76)
• pnpm --filter @paperclipai/server typecheck
• CI is running for head f0c3af7a08400aa6b44bc2ff225c437363c09cf5.

Risks

• Test-only change; runtime behavior is not modified.
• The main risk is fixture drift if future authorization semantics intentionally change; these tests should then be updated with that behavior change.

Model Used

OpenAI Codex, GPT-5 family, with GitHub CLI inspection and PR-description remediation.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work
• I have searched GitHub for duplicate or related PRs and linked them above
• I have either linked existing issues or described the issue in-PR following the relevant issue template
• I have run tests locally and they pass
• I have added or updated tests where applicable
• UI behavior has no visual layout change; screenshots are not applicable
• Documentation is not required for this test-only change
• I have considered and documented risks above
• All Paperclip CI gates are green
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups
• I will address all Greptile and reviewer comments before requesting merge

[allyblockcast]

🔗 Paperclip issue: BLO-19036
🔗 Paperclip issue: BLO-19170
🔗 Paperclip issue: BLO-18797

[allyblockcast]

🔗 Paperclip issue: BLO-19036
🔗 Paperclip issue: BLO-19170
🔗 Paperclip issue: BLO-18797

[allyblockcast]

Hey @allyblockcast[bot]! Before this PR can be reviewed, a few things need attention:

Missing or incomplete:

• Missing section: ## Thinking Path
• Missing section: ## What Changed
• Missing section: ## Risks
• Missing section: ## Model Used

Once updated, push a new commit and these checks will re-run automatically.

— commitperclip

[allyblockcast]

Ally — Consolidated PR Review

Lenses: pr-review-toolkit (code, tests, comments, errors, types) + gstack/review + native-codex.
Reviewed head: f0c3af7

Looks good. No Critical or Important issues found.

Strengths

• The descendant fixture excludes the actor from the child issue's assignee, creator, and manager-chain paths, so deny_missing_grant specifically pins that ancestry grants no access.
• The sibling fixture reproduces the load-bearing case from BLO-18797: an actor assigned to a sibling of the wake target remains authorized through the target issue's allow_self path, independent of ancestry.
• Both tests assert the decision reason as well as the boolean result, making future accidental policy-path changes visible.

Recommended Action

The diff is clean, but this PR is authored by app/allyblockcast. The Ally GitHub App cannot review its own PR, so this report is posted as a plain PR comment and does not satisfy review/ally-complete. This exact head must be reopened under an independent author before an App approval is possible.

[kkroo]

Approved: test-only coverage pins the cross-issue ancestry behavior and the sibling self-assignment allow path.