refactor(handlers): encode failure in best-effort lookups — 13 silent-success-masking sites (#756 Cat 2)

[ClintEastman02]

What & why

Closes #792. Widens 13 best-effort read paths so callers can distinguish a genuine empty result from a lookup failure, closing the silent-success-masking class (AI004, #756 Cat 2) — with no nosemgrep suppressions in this bucket, per the issue's constraint. Every site encodes failure in a result shape.

Approach

New shared discriminated union LookupResult<T> (cdk/src/handlers/shared/lookup-result.ts):

• { ok: true, value } — found
• { ok: false, absent: true } (LOOKUP_ABSENT) — genuinely nothing
• { ok: false, error } (lookupFailed) — the lookup itself broke

Helpers: lookupFound, LOOKUP_ABSENT, lookupFailed, isLookupFailure, lookupValueOr.

Converted reads

• slack-api.slackFetchTs
• orchestration-rollup.upsertEpicPanel
• linear-feedback.graphqlData
• linear-subissue-fetch.fetchIssueParentId
• jira-feedback
• github-webhook.findIterationReplyId
• linear-webhook.postIterationAck
• task-pr-number (extracted helper)
• CLI linear.queryLinearTeamKeys (local TeamKeysResult union)

Caller strategy

Purely best-effort callers collapse with lookupValueOr(r, null) at the call site — an explicit choice, and the failure is still logged at the source, so nothing is masked. The one caller that must not downgrade an orchestration child on failure (linear-webhook issue-parent lookup) branches on isLookupFailure and defers (stream replay re-drives once the surface recovers) instead of silently falling through to the standalone path.

Testing

• tsc --build clean (cdk, cli)
• Full suites: cdk 4471 passed, cli 903 passed
• Masking gate: 0 new findings introduced; all target findings for this bucket cleared, zero suppressions added

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 68.53659% with 129 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@12c9b63). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
cdk/src/handlers/linear-webhook-processor.ts	41.79%	39 Missing ⚠️
cdk/src/handlers/orchestration-reconciler.ts	44.89%	27 Missing ⚠️
cdk/src/handlers/shared/jira-feedback.ts	38.23%	21 Missing ⚠️
cli/src/commands/linear.ts	62.50%	15 Missing ⚠️
cdk/src/handlers/github-webhook-processor.ts	12.50%	7 Missing ⚠️
cdk/src/handlers/shared/slack-api.ts	58.82%	7 Missing ⚠️
cdk/src/handlers/shared/linear-subissue-fetch.ts	60.00%	6 Missing ⚠️
cdk/src/handlers/shared/linear-feedback.ts	87.87%	4 Missing ⚠️
cdk/src/handlers/shared/task-pr-number.ts	94.33%	3 Missing ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #863   +/-   ##
=======================================
  Coverage        ?   92.41%           
=======================================
  Files           ?      330           
  Lines           ?    95274           
  Branches        ?    10515           
=======================================
  Hits            ?    88051           
  Misses          ?     7223           
  Partials        ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.