[pr-review] Daily PR Code Quality Review — 38116017378 #67653

#67649 — centralize assignment receipt projections

• Exported type ClaimReceipt in pkg/workqueue/receipts.go has no doc comment (AssignmentReceipt and both ToReceipt methods do).
• Error handling: nothing missing, and no oversized functions.
• Tests contain real assertions, including JSON shape and no-aliasing checks.

#67648 — deterministic work-queue portfolio submission

• This diff is large (about 140 KB), so only the stagePlanIntents hunk was inspected in detail.
• stagePlanIntents is a new exported JS function with no doc comment. Its validation and conflict checks are packed into long single-line conditions, which hurts readability.
• It validates input and throws on invalid plans. No error handling is missing in the reviewed hunk.

#67646 — embed shared MCP stats in gateway server metrics

• GatewayServerMetrics.UnmarshalJSON copies fields back into the receiver even when json.Unmarshal returns an error. That can leave partially-decoded state. The new test asserts this behaviour for the invalid-type case, so it may be intentional.
• New methods have doc comments. Tests have strong assertions (JSON round-trips, assert.Same).
• No oversized functions.

#67644 — extract shared WorkflowRunFlags

• No issues. WorkflowRunFlags is documented, and the tests assert JSON shape, defaults and dispatch args.

#67643 — share scanner finding conversion

• NewFinding takes 7 positional parameters. The ADR already calls out the risk of mis-ordering line and column. Consider a small params struct if more call sites appear.
• NewFinding has a doc comment. The new tests make real assertions and no error handling is missing.