feat(signals): add repo-owner contribution policy snapshots

[JSONbored]

Parent roadmap: #82

Background

Repo owners need a way to express wanted work, blocked areas, testing expectations, and issue policies so Gittensory can guide miners toward useful work.

Goal

Persist repo-owner contribution policy snapshots and feed them into agent planning, branch preflight, and maintainer packets.

Current Behavior

Maintainer focus manifests/settings are planned, but a durable policy snapshot layer is still needed for downstream signals.

Desired Behavior

Gittensory can explain repo-specific preferences and discourage unwanted paths while preserving safe defaults.

Implementation Requirements

• Support settings/API-derived policy snapshots.
• Include wanted paths, blocked paths, preferred labels, linked issue policy, test expectations, and maintainer notes.
• Validate and warn on malformed policy.
• Feed policy into decision packs and local branch analysis.
• Keep private notes private unless explicitly public-safe.

Public/Private Output Boundaries

Signal data can inform private API/MCP outputs. Public GitHub output must use only sanitized, maintainer-friendly summaries and must not expose private scoreability or contributor scoring internals.

Acceptance Criteria

• Valid policy influences recommendations.
• Missing policy falls back safely.
• Malformed policy warns, not crashes.
• Private policy fields do not leak publicly.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally to avoid CI variance.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, queue pressure, source-upload safety, public/private boundaries, or upstream drift.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.
• MCP/local tooling must prove source contents are not uploaded.

Additional Test Scenarios

• Valid policy fixture.
• Missing policy fixture.
• Malformed policy fixture.
• Blocked path fixture.
• Private/public sanitizer regression.