feat(control-panel): add public-safe preview simulator

[JSONbored]

Background

Maintainers should be able to see exactly what Gittensory would do before allowing public comments or labels. Previewing prevents surprise and builds trust.

Goal

Let maintainers preview whether a sample PR would be skipped, labeled, commented, or checked, and what public output would say.

Current Behavior

GitHub App behavior is documented but not easily previewable from a control surface.

Desired Behavior

A maintainer can choose a sample PR and see skip/comment/label/check decisions with exact remediation for missing permissions.

Implementation Requirements

• Simulate confirmed miner, non-miner, bot, maintainer-author, and miner-detection unavailable cases.
• Render sanitized comment previews.
• Show label/check/comment permission requirements.
• Do not persist or post preview output.
• Use the same policy engine as production publishing.

Public/Private Output Boundaries

Public GitHub output must never include wallets, hotkeys, payout/reward estimates, raw trust scores, public score estimates, private reviewability, private scoreability context, or farming language. Private API/MCP/control-panel surfaces may show authenticated scoreability, blockers, projections, and evidence, but must not claim guaranteed payout outcomes.

Acceptance Criteria

• Confirmed miner, non-miner, bot, maintainer-author, and unavailable miner API cases are previewable.
• Public text is sanitized.
• Missing permissions are reported.
• Tests cover every public surface mode.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, source-upload safety, public/private boundaries, or telemetry privacy.
• MCP/local tooling must prove source contents are not uploaded when local metadata is involved.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.