feat(agent): add risk-adjusted action portfolio

[mkdev5]

Summary

• Add a risk-adjusted action portfolio to contributor decision packs, grouped into cleanup, wait, direct PR, issue-discovery, avoid, and maintainer-lane buckets.
• Surface portfolio data through API/OpenAPI and scoped agent run/context payloads.
• Cover deterministic ranking, scenario projections, legacy snapshot fallback, and public/private sanitizer boundaries.

Closes #94

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None. npm run test:ci passed end to end. Local coverage summary: statements 99.02%, branches 97.06%, functions 98.11%, lines 99.62%.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include screenshots or a short recording.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• API/OpenAPI contract: ContributorDecisionPack now includes actionPortfolio; the UI OpenAPI artifact was regenerated.
• Agent contract: planner run/context payloads include a repo-scoped portfolio for selected decisions.
• No visible UI behavior changed; screenshots are not applicable.
• No changelog update, per CONTRIBUTING.md guidance for ordinary feature PRs.

[JSONbored]

@MkDev11 the portfolio grouping is a useful direction, and the deterministic buckets make the decision pack easier to reason about.

A few notes:

• CI is green on the branch.
• The branch is now stale against current main.
• Conflicts are in src/services/agent-orchestrator.ts and test/unit/decision-pack.test.ts.
• It also touches apps/gittensory-ui/public/openapi.json; the frontend-touch screenshot rule still needs to be satisfied with actual evidence.

Required changes:

• Resolve the current merge conflicts.
• Re-run OpenAPI generation/checks after the conflict fix.
• Attach screenshot/recording evidence for the frontend-touched surface, or remove the frontend artifact change if it is unnecessary.

Validation expected:

• Re-run npm run test:ci.
• Confirm portfolio, orchestrator, and decision-pack tests pass after the rebase.

[mkdev5]

@JSONbored fixed the conflicts

[JSONbored]

@MkDev11 please fix merge conflicts.

@MkDev11 no current code changes requested. The branch is clean, CI is green, and the old conflict blocker appears resolved.