I won't speak for the core team's priorities but they tend to tackle things that have more "ask" votes first so I suspect an edge case in cl-format is considered pretty low priority. Looking at the JIRA, it shows "triaged", a patch with "code and test", but priority "minor", so they've just been dealing with bugs that affect more people. Sometimes patches take a while to get incorporated (years, and multiple releases, if they're not affecting many people).

(but, hopefully, this thread will at least get you an answer to your Q in JIRA about the regression test)

do bug fixes have risk assessments? or effort assessments?

I believe for ones that the Clojure core development team has spent noticeable amount of time doing design work to evaluate, they have effort assessments. These are private to their team, not published. You can see examples of this in this talk by Rich Hickey: https://github.com/matthiasn/talk-transcripts/blob/master/Hickey_Rich/DesignInPractice.md

Contributing to Clojure core is often an exercise in patience, is I believe a fair statement.

Publicly, bug fixes have exactly what you can find out about them in the JIRA ticket and/or http://ask.clojure.org questions related to them.

Privately, I have no idea what additional information might be tracked about them.