Wire real selfPlagiarismCandidate/selfPlagiarismRecentSubmissions into the Governor chokepoint

[JSONbored]

Context

chokepoint.ts's selfPlagiarismCheck stage -- a fully built, tested pure classifier comparing a prospective submission's diff fingerprint against the miner's own recent submission history via token-set Jaccard similarity -- is always skipped in production, because GovernorChokepointInput.selfPlagiarismCandidate/selfPlagiarismRecentSubmissions are never supplied by any real caller (attempt-runner.js's own header names this exact gap, the same one covering reputationHistory). This is one of the Governor's own documented defense layers, silently inactive.

A prerequisite for this issue just shipped in the same session: recordOwnSubmission's write side is now wired into attempt-cli.js with a real fingerprint (fingerprintFromChangedFiles, gittensory-engine's self-plagiarism.ts), and governor-state.js's listRecentOwnSubmissions already returns real OwnSubmissionRecord[] data once populated -- both inputs this stage needs now have a real source going forward.

Dependencies

None to start -- independently shippable. Builds on the now-real recordOwnSubmission/listRecentOwnSubmissions write path and the new fingerprintFromChangedFiles helper.

Requirements

1. At the point attempt-runner.js builds the open_pr chokepoint call (evaluateGovernorChokepointGatePersisted), compute the CURRENT prospective submission's fingerprint the same way attempt-cli.js's new recordOwnSubmission call does (fingerprintFromChangedFiles over the handoff packet's changedFiles), and pass it as selfPlagiarismCandidate.
2. Pass governor-state.js's real listRecentOwnSubmissions({ repoFullName }) result as selfPlagiarismRecentSubmissions.
3. attempt-input-builder.js's buildAttemptGovernorContext currently builds the governor context ONCE, early, in attempt-cli.js -- before the handoff packet with real changed files even exists (it's only known after the loop reaches handoff, inside runMinerAttempt). Determine whether the governor object needs a late-augmentation step inside attempt-runner.js itself, immediately before the chokepoint call, rather than trying to fit this into attempt-cli.js's single early snapshot.
4. Out of scope: changing selfPlagiarismCheck's own similarity threshold or election logic (self-plagiarism.ts).

Deliverables / Acceptance Criteria

• A real submission's fingerprint and the miner's real recent-submission history both reach the chokepoint call
• A near-duplicate submission (by real Jaccard similarity) is measurably throttled in a real chokepoint evaluation (regression test)
• A genuinely distinct submission is not throttled

Test Coverage Requirements

This PR must ship with full test coverage for every changed line and branch -- the repo's Codecov patch gate requires 99%+ coverage and the house standard is to aim for 100%, including both sides of every conditional/nullish-coalescing branch introduced.

Expected Outcome

The self-plagiarism throttle -- fully built and tested since Wave 3 -- finally receives real data, closing a genuine gap before Wave 5's higher-stakes, paid rented-loop context.

Links & Resources

• packages/gittensory-miner/lib/attempt-runner.js's own header comment (the documented gap)
• packages/gittensory-engine/src/governor/self-plagiarism.ts (selfPlagiarismCheck, fingerprintFromChangedFiles)
• packages/gittensory-miner/lib/governor-state.js's recordOwnSubmission/listRecentOwnSubmissions

[linear-code]

JSO-3888