fix(review): route isAoneHostFamily through the shared host normalizer

`isAoneHostFamily` re-inlined the exact normalization chain
(`toLowerCase()` + strip `:\d+$` + strip trailing dot) that
`normalizeHostSpelling` already owns, so the helper's contract comment —
"both host predicates route through it" — was false for the third
predicate. The two copies were character-for-character equivalent, so
behaviour was identical; this is a consistency defect, not a live bug.

Route the family predicate through `normalizeHostSpelling`, leaving the
helper, the canonical write router and the `.alibaba-inc.com` wildcard
untouched.

Covered by a new `isAoneHostFamily` describe block; the paired mutation
witness (helper returns `host + '.invalid'`) leaves those assertions
green before the change and turns them red after, while the
hostsEquivalent/isAoneCanonicalHost control legs fail in both runs.

Refs #9601 (finding rc:3820959694)

Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-issue-patrol/jmvv8372lq5

packages/cli/src/commands/review/lib/remote-match.test.ts

@@ -11,6 +11,7 @@ import {
   normalizeSegment,
   hostsEquivalent,
   isAoneCanonicalHost,
+  isAoneHostFamily,
 } from './remote-match.js';
 
 describe('parseRemoteUrl', () => {
@@ -472,3 +473,31 @@ describe('isAoneCanonicalHost', () => {
     expect(isAoneCanonicalHost('')).toBe(false);
   });
 });
+
+describe('isAoneHostFamily', () => {
+  it('accepts both canonical Aone hosts', () => {
+    expect(isAoneHostFamily('gitlab.alibaba-inc.com')).toBe(true);
+    expect(isAoneHostFamily('code.alibaba-inc.com')).toBe(true);
+  });
+
+  it("normalizes the spelling variants through the shared helper", () => {
+    // Same three spellings `hostsEquivalent` and `isAoneCanonicalHost`
+    // admit: case, a port kept inside the CR-URL host capture, and the
+    // FQDN trailing dot.
+    expect(isAoneHostFamily('CODE.ALIBABA-INC.COM')).toBe(true);
+    expect(isAoneHostFamily('code.alibaba-inc.com:443')).toBe(true);
+    expect(isAoneHostFamily('code.alibaba-inc.com.')).toBe(true);
+  });
+
+  it('accepts the wider .alibaba-inc.com family', () => {
+    // Family detection is deliberately wider than the write router: a GHE
+    // instance must still be recognised as Aone here.
+    expect(isAoneHostFamily('ghe.alibaba-inc.com')).toBe(true);
+  });
+
+  it('rejects non-Aone and empty hosts', () => {
+    expect(isAoneHostFamily('github.com')).toBe(false);
+    expect(isAoneHostFamily(undefined)).toBe(false);
+    expect(isAoneHostFamily('')).toBe(false);
+  });
+});

packages/cli/src/commands/review/lib/remote-match.ts

@@ -74,7 +74,7 @@ export function isAoneCanonicalHost(host: string | undefined): boolean {
  *  detection and then be refused by a gate that normalized differently. */
 export function isAoneHostFamily(host: string | undefined): boolean {
   if (!host) return false;
-  const h = host.toLowerCase().replace(/:\d+$/, '').replace(/\.$/, '');
+  const h = normalizeHostSpelling(host);
   return (
     h === 'gitlab.alibaba-inc.com' ||
     h === 'code.alibaba-inc.com' ||