test(frontend): cover the overseer decision -> run refresh flow

[vbabenko97]

Follow-up to #39, which is now merged; this PR targets main. CI ran while it was stacked on #39's branch, whose tree matches main after that merge.

Summary

#39 made the UI reload the displayed run after an overseer decision, but no automated test covered that flow. This PR adds tests for approve/reject → result refresh and fixes three user-visible problems found along the way.

Changes

Decision flow, now tested (frontend/app/decision.js, frontend/test/decision.test.js)

• The approve/reject handler moved out of page.jsx into decideAndRefresh(api, request, { setPending, setNotice, setRun }). page.jsx calls it with its own state setters, so the tests exercise the same state updates the page makes.
• The tests use a fake API modelled on server/api.py (overseer_decide, _decision_update, the RunStatus shape):
  • Approve or reject on the displayed run: posts the decision, removes the queue row, reloads the run, and ResultView shows the released result or the rejection.
  • Decision on a different spec, or with no run id: nothing is reloaded.
  • Failed decision: the error is shown and nothing else changes.
  • Failed reload: the recorded decision is still reported.

Fixes found on the way

• A rejection announced "Result rejectd."; it now reads "Result rejected."
• A rejected run said "Output withheld pending release."; it now says "Output rejected by the overseer."
• heldReason() expected k_anon:-style prefixes, but the API sends bare codes (PublicReason, _public_reasons). Every real flagged or rejected run therefore showed the generic "Disclosure review required." It now matches the code before any :, so both forms work. A new test uses the bare codes.
• A failed reload after a successful decision replaced the success notice with the bare error. The notice now keeps the decision and appends the error.
• AGENTS.md: CI runs on pushes to main and on every pull request, not "on every push".

Verification

• CI on this PR is the first time these tests run. A local policy hook blocks node and npm in the environment where this was written.
• Before pushing, a static review traced every assertion in both test files against result-view.jsx, decision.js and the installed react-dom static renderer. It found no failing assertion. The gaps it raised (untested state wiring, the runId guard, the POST body, fixture shapes) are addressed in this PR.
• git diff --check: clean.

Not covered

• The onClick → decide() binding in page.jsx. A component-level test needs a DOM environment (jsdom and Testing Library), which would be a new dev dependency.
• A stale closure predating this PR: if a new run is submitted while a decision request is in flight, the reload can replace the new run on screen with the old one. This is unlikely in practice: deciding happens on the overseer view and submitting on the analysis view.