fix(#2027): use start comment author instead of GetAuthenticatedUser in analyzeTimeline

[fullsend-ai-coder]

analyzeTimeline called GetAuthenticatedUser to determine the bot's username for identifying agent-posted comments on the timeline. This API call fails for GitHub App installation tokens (/user returns 403, /app fallback returns 401), causing agentPosted to stay false and PostCompletion to post a new comment instead of editing the start comment in place.

The start comment's Author field is already available from ListIssueComments at comments[startIdx]. Use it directly instead of making an extra API call, eliminating the fragile /user → /app fallback chain entirely.

Updated the GetAuthenticatedUserError test to verify the new behavior: bot identity is now derived from the start comment, and GetAuthenticatedUser is never called.

Note: make lint could not run in sandbox (shellcheck_py download blocked by network policy). go vet and go test passed.

---

Closes #2027

Post-script verification

• Branch is not main/master (agent/2027-use-start-comment-author)
• Secret scan passed (gitleaks — 5faa79f06ad8dbac4b7f08aa7a6ff79772c74552..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

Site preview

Preview: https://9406a488-site.fullsend-ai.workers.dev

Commit: db60ac6479e09844a2e9727c921948c438f3780c

[fullsend-ai-review]

🤖 Review · Started 3:40 PM UTC
Commit: d0ac11b · View workflow run →

[fullsend-ai-review]

Review

Findings

No findings.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 3:40 PM UTC · Completed 3:46 PM UTC
Commit: d0ac11b · View workflow run →

[fullsend-ai-retro]

🤖 Retro · Started 4:35 PM UTC
Commit: d0ac11b · View workflow run →

[fullsend-ai-retro]

Retro: PR #2028 — fix(#2027): use start comment author instead of GetAuthenticatedUser

Workflow timeline: Issue #2027 → triage (3.5 min) → code (7.5 min) → PR #2028 opened → review approved (7 min) → human approved (~43 min later) → merged. Total: ~68 min, with ~18 min of active agent work. No fix cycles — code agent got it right on the first attempt.

Overall assessment: This was a clean, efficient workflow. The code agent produced a correct, well-tested fix for a real production bug (API call failing on GitHub App installation tokens). The change was small (+15/-17, 2 files), well-scoped, and the test was properly updated.

One observation (already tracked): The review agent approved with a completely empty body — no reasoning or analysis was visible. While the approval was correct (the change is safe, edge cases are handled, tests are adequate), a blank approval is indistinguishable from "I didn't look at this." This is already tracked in #1046 ("Review agent APPROVED GitHub review should include a brief body, not be empty").

No new proposals. The only improvement opportunity identified is already covered by existing issue #1046.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 4:35 PM UTC · Completed 4:43 PM UTC
Commit: d0ac11b · View workflow run →