integrity_level_rank and integrity_for_level both contained an identical 4-way case-insensitive if/else chain parsing integrity level strings. Adding a new level required updating both in sync with no compiler enforcement.

Changes

• MinIntegrity::from_policy_str(level: &str) -> Option<Self> — adds the reverse direction of as_str(). Trims whitespace, case-insensitive match, returns None for unrecognised values.

impl MinIntegrity {
    pub(crate) fn from_policy_str(level: &str) -> Option<Self> { ... }
}

• integrity_level_rank / integrity_for_level refactored — both now delegate to match MinIntegrity::from_policy_str(level). The parsing logic lives in exactly one place; exhaustive match means the compiler will flag any missed case site when a new variant is added.

• MinIntegrity::from_policy_str unit tests — known levels, case insensitivity, whitespace trimming, unknown input (None), and roundtrip with as_str().

• extract_repo_from_item unit tests — previously untested despite driving repo attribution for every labeled item. New tests cover all five lookup strategies (direct full_name, repository.full_name, base.repo.full_name, head.repo.full_name, URL parsing fallback) plus priority ordering and the empty fallback.