fix(review): trim LOOPOVER_PUBLIC_STATS before the truthy-flag regex test

[shin-core]

What & why

isPublicStatsEnabled checked the LOOPOVER_PUBLIC_STATS env flag against an anchored truthy regex on the raw, untrimmed value:

return /^(1|true|yes|on)$/i.test(env.LOOPOVER_PUBLIC_STATS ?? "");

Every sibling boolean-env-flag checker in the codebase trims first — e.g. pr-reconciliation.ts's isPrReconciliationEnabled:

return /^(1|true|yes|on)$/i.test((env.LOOPOVER_PR_RECONCILIATION ?? "").trim());

isPublicStatsEnabled was the odd one out. A trailing newline or surrounding whitespace — plausible via wrangler secret put reading from a file, or CI/CD injecting an env var with a trailing newline — makes the anchored regex fail to match even though the operator clearly meant to enable the flag: /^(1|true|yes|on)$/i.test("true\n") is false. The sibling's trimmed behaviour is deliberately regression-tested; isPublicStatsEnabled had no .trim() and no equivalent test.

The fix

Trim env.LOOPOVER_PUBLIC_STATS before the regex test, matching the established convention:

return /^(1|true|yes|on)$/i.test((env.LOOPOVER_PUBLIC_STATS ?? "").trim());

Unchanged: the manifestOverride?.present early-return, and every already-clean value (no leading/trailing whitespace) evaluates exactly as before — this is a whitespace-robustness fix only.

Tests (test/unit/public-stats.test.ts)

• isPublicStatsEnabled({ LOOPOVER_PUBLIC_STATS: "true\n" }) (and " 1 ", "\ton\t", " yes") now returns true; a whitespace-padded unrecognised value (" maybe ", " false ", "\n0\n") stays false — fails on main.
• The existing "is truthy only for 1/true/yes/on" test already pins the already-clean regression ("true", "0", "", undefined) and still passes unchanged.

Validation

• Diff coverage on src/review/public-stats.ts is 100% (the .trim() line; no new branch).
• npm run typecheck clean; npm run engine-parity:drift-check passes (not a twin); npm run dead-exports:check clean; the public-stats suite and its parity-invariant test green.
• git diff --check clean; no schema/migration/generated-artifact change.

Closes #10329

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.