Devin: normalize GitHub bot login suffix in exact author binding

[jeffhuber]

Part of #901. Follow-up to #936.

Problem

Retrospective collection for the completed #932 hosted Devin work order now reaches fresh GitHub verification, but the exact account is spelled differently across trusted surfaces. The persisted dispatcher identity is devin-ai-integration[bot], while GitHub GraphQL reports devin-ai-integration for the same numeric author ID 158243242. Repository, issue, PR, branch, base, and exact head all match.

GitHub's terminal bot suffix alias should not defeat exact-account verification. The numeric author ID must remain exact, and normalization must not accept a different login or a non-terminal variation.

Scope

Normalize only one terminal [bot] suffix when comparing the trusted work-order author login with fresh GitHub PR metadata. Continue to require the exact numeric author ID and every existing repository, issue, PR, head repository, branch, base, head SHA, and allowed state binding.

Acceptance criteria

• The same exact numeric account is accepted when one login spelling differs only by one terminal [bot] suffix.
• A different numeric author ID is rejected even when the normalized login matches.
• A different login is rejected even when the numeric author ID matches.
• Non-terminal, repeated, or otherwise altered bot markers are rejected.
• Existing open/merged recovery and closed-unmerged rejection tests remain green.
• Focused tests, Ruff, compileall, privacy scan, package checks, normal CI, and code-mower/gate pass.

Code Mower delivery

Produce exactly one independently reviewable PR. Record Code Mower Codex as the named builder and obtain an independent Code Mower Claude review against the exact head. Resolve every P0/P1/P2 finding. Do not merge until exact-head evidence is reported. Keep public/cloud evidence metadata-only.