fix(usecase): carry the pack's recommended profile into the governance link

[CybotTM]

The pack detail page prints the governance profile a pack recommends, then says "Compare this posture with what is in force" and links the readout. The link carried no profile, so the operator landed on an unselected readout and had to find the recommendation again by hand — one screen after reading its name.

One thing the issue expected turned out to be already done

#778 asked for the route parameter "plus whatever the readout needs to honour a pre-selection". The readout needs nothing: LlmModuleController::governanceAction() already reads profile off the query string, and its own profile buttons already link that way. Only the sender was missing.

So this is routeUrl() gaining an optional extra-parameter argument and one call site using it. GovernanceProfile is a backed enum, so the value is the same string the buttons use.

The test dispatches the controller, which is new here

UseCasePackRenderTest hands governanceUrl to a view as a fixed string. That is right for what those tests check — the template's markup — and it means none of them could ever have caught this, because the value under test was supplied by the test.

So this one runs the real action and asserts on the rendered body. Nothing in the suite dispatched a backend module action before, and three things were needed to make it work; each is commented where it sits rather than left as incantation:

• the request must exist before the controller is resolved — Extbase's ConfigurationManager captures the ambient one, which the neighbouring DI test already works around;
• BackendViewFactory resolves template paths from the route's packageName, so the request needs a route attribute;
• ModuleTemplate translates its own chrome from $GLOBALS['LANG'].

Seen to fail first. With the argument removed the assertion fails on the rendered body; restored, the fifteen tests in the class pass.

Gates: phpstan level 10 clean, unit 7137 pass, functional -d sqlite on UseCasePack* 32 pass, cgl and rector -n stable at PHP 8.2 after applying.

Closes #778

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Automated approval for maintainer PR

All automated quality gates passed. See SECURITY_CONTROLS.md for compensating controls.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov]

Codecov Report

❌ Patch coverage is 0% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.43%. Comparing base (105f0c1) to head (242ec1e).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
...asses/Controller/Backend/UseCasePackController.php	0.00%	5 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #811      +/-   ##
============================================
- Coverage     87.43%   87.43%   -0.01%     
  Complexity     9710     9710              
============================================
  Files           566      566              
  Lines         31418    31420       +2     
============================================
  Hits          27471    27471              
- Misses         3947     3949       +2     

Flag	Coverage Δ
unit	65.37% <0.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...asses/Controller/Backend/UseCasePackController.php	0.00% <0.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[CybotTM]

Review record — no Copilot review exists for this diff (monthly, account-wide quota exhausted), so the green gate is not a read of the change. What was checked:

One premise of the issue was wrong and checking it removed most of the work. #778 asked for the route parameter "plus whatever the readout needs to honour a pre-selection". The readout needs nothing — governanceAction() already reads profile off the query string and its own buttons already link that way. Only the sender was missing, so this is one argument and an optional parameter on a private helper.

The existing tests could not have caught this, and that is why a new kind of test is here. UseCasePackRenderTest hands governanceUrl to a view as a fixed string; it can only prove the template prints what it is given. Asserting a URL the controller builds needs the controller to build it, so this dispatches the real action. Nothing in the suite did that before — it needs the request to exist before the controller is resolved, a route carrying packageName, and $GLOBALS[LANG]. Each is commented where it sits rather than left as incantation, because the next person to dispatch an action will hit all three.

Seen to fail first: with the argument removed the assertion fails on the rendered body; restored, the fifteen tests in the class pass.

Merge safety checked rather than assumed: this branch and #801 both add to [Unreleased]. Merged together locally on top of main, the result has three headings, no bullet twice, and 14 bullets where 12 + 1 + 1 is expected — a conflict-free auto-merge of this file is exactly the case this repository has been burned by, so the content was counted rather than the exit code trusted. #810 does conflict and is deliberately held back for a rebase.

phpstan level 10 clean, unit 7137 pass, functional -d sqlite on UseCasePack* 32 pass, cgl and rector -n stable at PHP 8.2.

Merging on that basis.