gitea: subscribe the review hook to pull_request_review

The hook registered with no events at all and delivered nothing.
"pull_request_review_comment" and "pull_request_review_rejected" are real
HookEventTypes and real X-GitHub-Event-Type values, but they are not
things gitea's hook API accepts. updateHookEvents
(routers/api/v1/utils/hook.go) matches a fixed list of api names and
silently ignores anything else, so every event flag stayed false, the POST
succeeded, and the hook sat there inert.

There is no narrower api name: HasEvent (models/webhook/webhook.go)
collapses approved, rejected and review-comment onto
HookEventPullRequestReview, so `pull_request_review` is a single switch for
all three. Approvals consequently cannot be excluded at the hook any more.
They now cross the wire as "pull_request_approved", which is not in the
route's event list, so Hermes ignores them on the event match -- before the
filter script and before any LLM call. Gitea's delivery log will show them
answered 200/ignored, which is intended.

That makes three namespaces for the same event rather than two, so the
tables in both nix files and the README now carry the api column, and the
README warns about the silent-ignore behaviour that hid this.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S94o42aQ8VkBmEWvDem5xa

services/dev/gitea.nix

@@ -25,30 +25,36 @@ let
   # dispatches on (http://mars.orbit.sol:8644/webhooks/<route>), so it must
   # match a key in the route config that hosts/mars/hermes-agent.nix writes.
   #
-  # `events` are SUBSCRIPTION names, and gitea reuses these strings in a
-  # second, colliding namespace on the wire — see the long comment on the
-  # route unit in hosts/mars/hermes-agent.nix. "pull_request_comment" HERE
-  # means a timeline comment on a pull request; the same string in
-  # X-GitHub-Event means a review. The two files therefore name the same
-  # event differently on purpose, and neither is a typo:
+  # `events` are the strings gitea's HOOK API accepts. That set is coarser
+  # than gitea's internal HookEventType set, and both collide on spelling with
+  # the wire names Hermes matches on — three namespaces, one of which is a
+  # trap. From routers/api/v1/utils/hook.go (updateHookEvents),
+  # models/webhook/webhook.go (HasEvent) and modules/webhook/type.go (Event()):
   #
-  #   here (subscription)            there (route events)
-  #   ----------------------------   --------------------
-  #   pull_request_comment           issue_comment
-  #   pull_request_review_comment    pull_request_comment
-  #   pull_request_review_rejected   pull_request_rejected
+  #   api event (here)       delivers              wire name (mars route)
+  #   --------------------   -------------------   ----------------------
+  #   pull_request_comment   comment on a PR       issue_comment
+  #   pull_request_review    review with a body    pull_request_comment
+  #                          changes requested     pull_request_rejected
+  #                          approval              pull_request_approved
   #
-  # Hermes would drop everything else anyway (each route matches on
-  # X-GitHub-Event before any LLM call, and then runs a filter script), so
-  # subscribing narrowly here is defence in depth rather than the only gate:
-  # it keeps traffic that can never be acted on from crossing the wire and
-  # reaching the agent's process at all.
+  # So this file and hosts/mars/hermes-agent.nix name the same event
+  # differently on purpose, and neither is a typo.
   #
-  # Approvals (pull_request_review_approved) are deliberately absent: an
-  # approval is darman signing off, not asking for work, and waking an agent
-  # run on every LGTM is pure cost. Adding it means adding it BOTH here and
-  # to prReviewEvents/ALLOWED_REVIEW_TYPES on mars — as "pull_request_approved"
-  # there, per the table above.
+  # THE TRAP: updateHookEvents silently ignores strings it does not recognise,
+  # so a plausible-looking but non-API name leaves the hook registered with no
+  # events at all, delivering nothing and reporting no error. That is exactly
+  # what "pull_request_review_comment" did here — a real HookEventType, and a
+  # real value of X-GitHub-Event-Type, but not an API event name.
+  #
+  # There is no narrower name for reviews: HasEvent collapses approved,
+  # rejected and review-comment onto HookEventPullRequestReview, so
+  # `pull_request_review` is a single switch for all three. Approvals
+  # therefore cannot be excluded here. They are dropped on the mars side
+  # instead — the route's event list has no "pull_request_approved", so Hermes
+  # answers {"status": "ignored"} without running the filter or spending a
+  # token. Expect approvals in gitea's delivery log, answered 200 and ignored;
+  # that is the design, not a failure.
   giteaHermesHooks = [
     {
       name = "PR comments Hermes";
@@ -58,7 +64,7 @@ let
     {
       name = "PR reviews Hermes";
       route = "gitea-pr-reviews";
-      events = [ "pull_request_review_comment" "pull_request_review_rejected" ];
+      events = [ "pull_request_review" ];
     }
   ];
 in