feat(ci): fix the free failures for free — deterministic tier before the model #5578

The requirement: fixing a CI failure must not depend on the Anthropic bill being paid.

It already didn't have to. classifyFailure() recognises lockfile drift, formatting and import order; tryMechanicalRepair() fixes all three by running the formatter and pushing the result. No model, no key, no balance. Both are tested — and both have been sitting in the tree unused. Their only caller is repairGateFailure(), which auto-repair.ts:415 documents as having no route or hook callers.

So a lockfile mismatch went straight to Claude, and today straight to a 400 credit balance is too low.

What changes

The healer tries the deterministic tier first, and only escalates when no pattern matches. Three of the most common red builds on any Bun repo now get fixed with zero API dependency.

Placed ahead of the AI quota gate, not just the AI call. That gate exists to protect an AI budget this tier never spends — refusing a free repair for lack of AI credit would be the same category error this whole day has been about.

Guards

• Refuses the default branch. tryMechanicalRepair pushes straight to the branch: correct on a feature branch (the push starts a fresh CI run, which is the point), wrong on main, where it's an unreviewed bot commit to the trunk. Fixing a red trunk stays a human's call.
• Falls through, never blocks. No pattern match → null. Failed repair → null. Thrown → caught, null. A broken free tier must not cost us the paid one.

Tests

They pin the ordering, not the implementation — mechanical before both analyzeFailedWorkflowRun and assertAiQuota, plus the default-branch refusal and the fall-through.

Ordering is the property that matters here: if someone moves the call below the AI path, the tier still "works" and quietly stops mattering.