feat(github-agent): add public-safe answer cards

[oktofeesh1]

Summary

• add a reusable public answer-card contract for @gittensory GitHub replies
• add source/freshness notes and collapsible safe-details sections
• extend public sanitizer coverage for scoreability, public score estimates, and private reviewability language

What changed

• Wrapped command-specific reply content in a shared card shape with summary, findings, evidence, next actions, and source/freshness notes.
• Keeps long safe details in collapsible sections so public comments stay concise.
• Runs card fields through the public sanitizer before posting and again at final comment assembly.
• Adds regression coverage for card sections, citation/source notes, refresh and empty fallbacks, safe details, duplicate-line dedupe, and forbidden public-output terms.

Why

Closes #141. Public GitHub replies now have one consistent contract instead of command-specific formatting, while private scorer and planning context remains out of public comments.

Validation

• npm run typecheck
• npm run test:unit -- test/unit/github-commands.test.ts
• npm run test:coverage
• npm run test:ci
• Codex Security diff scan: 2/2 worklist rows reviewed, no reportable findings.

Notes

• This PR keeps the existing command set and authorization model unchanged.
• It is intentionally separate from the command-router v2 PR so the answer-card contract can be reviewed on its own.

[JSONbored]

@oktofeesh1 This is ready from my side. The public-safe answer-card work is green and merge-clean.

A few notes:

• The GitHub command output shape is covered by tests.
• The formatting keeps public GitHub responses structured without exposing private maintainer context.
• No requested changes from me.