feat(github-agent): add public-safe answer cards with citations

[JSONbored]

Background

GitHub command replies need to be useful but not overwhelming. Standard answer cards keep output consistent, cited, and safe.

Goal

Create reusable public-safe answer cards with short findings, evidence bullets, next actions, and source/freshness notes.

Current Behavior

Public output safety exists, but command-specific answer formatting needs a reusable contract.

Desired Behavior

Every public command reply has a consistent structure that is concise, actionable, and safe.

Implementation Requirements

• Create shared card templates for command replies.
• Include source/freshness notes without exposing private internals.
• Use collapsible sections only for safe details.
• Run all card text through the public sanitizer.
• Keep private scoreability/reviewability/risk details behind authenticated surfaces.

Public/Private Output Boundaries

Public GitHub output must never include wallets, hotkeys, payout/reward estimates, raw trust scores, public score estimates, private reviewability, private scoreability context, or farming language. Private API/MCP/control-panel surfaces may show authenticated scoreability, blockers, projections, and evidence, but must not claim guaranteed payout outcomes.

Acceptance Criteria

• Every public answer is concise and actionable.
• Private scoring/reward/reviewability does not leak.
• Long output uses collapsible details only when safe.
• Tests cover forbidden language and citation rendering.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, source-upload safety, public/private boundaries, or telemetry privacy.
• MCP/local tooling must prove source contents are not uploaded when local metadata is involved.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.