test: rewrite 6 stale tests to match current source behavior

Two clusters of pre-existing failures fixed by aligning tests with the
source they were meant to verify (not by changing source):

1. ultrareviewCommand (4 fails)
   The 4 "preflight integration" tests assumed `call` makes an axios POST
   and branches on `action: proceed | blocked | confirm`. That integration
   was removed; the current `call` branches on `checkOverageGate()`'s four
   `kind` values. Replaced with 6 tests covering each gate branch
   (`not-enabled`, `low-balance`, `needs-confirm`, `proceed`), arg
   pass-through to launchRemoteReview, and the null-launch failure path.

2. autonomy-lifecycle-user-flow (2 fails)
   The Bun.spawn'd subprocess used cwd=tempDir, where Bun couldn't resolve
   the `src/*` tsconfig path alias (it's resolved from cwd's tsconfig, not
   the entrypoint file's). Switched the entrypoint to the bundled
   dist/cli.js (aliases pre-resolved) and added a beforeAll that lazy-builds
   the bundle if missing — handles the CI ordering where `bun test` runs
   before `bun run build`.

Local: 5345/5345 pass (was 5339/5345).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/integration/autonomy-lifecycle-user-flow.test.ts

@@ -1,9 +1,22 @@
-// NOTE: isolation flake, not pollution. The subprocess Bun.spawn'd in
-// runAutonomyCli does not inherit the test runner's tsconfig path-alias
-// resolution, so it reports `Cannot find module 'src/bootstrap/state.js'
-// from src/utils/startupProfiler.ts` even when this file is run alone.
-// Out of scope for the test-flake-fix pass; needs subprocess-launcher rework.
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
+// Why we use the BUILT bundle instead of src/entrypoints/cli.tsx:
+// `Bun.spawn` runs the CLI in a fresh process whose cwd is the per-test
+// tempDir. Bun resolves the `src/*` tsconfig path alias from the cwd's
+// nearest tsconfig.json, NOT from the entrypoint file's directory — so a
+// subprocess started with cwd=tempDir cannot resolve `import 'src/bootstrap/
+// state.js'`. The built dist/cli.js has all aliases pre-resolved, which
+// makes it usable from any cwd.
+//
+// CI runs `bun test` BEFORE `bun run build`, so we lazy-build cli.tsx in a
+// `beforeAll` if dist/cli.js is missing. Local runs after `bun run build`
+// just see the file and skip the build.
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+} from 'bun:test'
 import { existsSync, mkdtempSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
@@ -18,12 +31,37 @@ import {
 } from '../../src/utils/autonomyRuns'
 import { listAutonomyFlows } from '../../src/utils/autonomyFlows'
 
-const CLI_ENTRYPOINT = resolve(import.meta.dir, '../../src/entrypoints/cli.tsx')
+const CLI_ENTRYPOINT = resolve(import.meta.dir, '../../dist/cli.js')
+const PROJECT_ROOT = resolve(import.meta.dir, '../..')
 
 let tempDir = ''
 let configDir = ''
 let previousConfigDir: string | undefined
 
+async function ensureCliBundle(): Promise<void> {
+  if (existsSync(CLI_ENTRYPOINT)) return
+  const proc = Bun.spawn({
+    cmd: [process.execPath, 'run', 'build'],
+    cwd: PROJECT_ROOT,
+    stdin: 'ignore',
+    stdout: 'pipe',
+    stderr: 'pipe',
+  })
+  const [stderr, exitCode] = await Promise.all([
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ])
+  if (exitCode !== 0 || !existsSync(CLI_ENTRYPOINT)) {
+    throw new Error(
+      `Failed to build dist/cli.js for autonomy CLI tests (exit=${exitCode}):\n${stderr}`,
+    )
+  }
+}
+
+beforeAll(async () => {
+  await ensureCliBundle()
+}, 120_000)
+
 async function runAutonomyCli(args: string[]): Promise<string> {
   const proc = Bun.spawn({
     cmd: [process.execPath, CLI_ENTRYPOINT, 'autonomy', ...args],