feat: add agent action explanation cards

[mkdev5]

Summary

• Add deterministic explanation cards to agent action output with why-now copy, scoreability blockers, risk, maintainer friction, expected impact, grouped blockers, rerun guidance, and public-safe variants.
• Wire cards through persisted agent run loading, API/OpenAPI responses, and MCP CLI text output while keeping JSON-first MCP output unchanged.
• Add regression coverage for card shape, blocker grouping, public sanitizer boundaries, API contract, OpenAPI schema, and MCP CLI rendering.

Closes #97

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• npm run test:ci / CI validate on head fd74633
• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None. npm run test:ci passed locally and CI validate passed on the current PR head. Local coverage summary: statements 98.98%, branches 97.02%, functions 98.19%, lines 99.59%.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include screenshots or a short recording. (N/A: no visible UI changes; the UI-path diff is generated OpenAPI JSON only.)
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• No screenshot or recording is attached because no visible UI surface changed; UI validation ran because OpenAPI output is regenerated.
• No changelog update included because this is not a release-prep PR.
• apps/gittensory-ui/public/downloads/ was generated locally by npm run ui:build and intentionally left out of the commit.

[JSONbored]

@MkDev11 the explanation-card shape is useful: the “why now”, blocker grouping, rerun guidance, and public-safe variants are the right kind of deterministic context.

A few notes:

• CI is green on the branch.
• The branch no longer merges cleanly into current main.
• Conflicts are in src/services/agent-orchestrator.ts and test/unit/agent-orchestrator.test.ts.
• This also touches apps/gittensory-ui/public/openapi.json, so UI artifact validation and screenshot policy need to be handled explicitly.

Required changes:

• Resolve the merge conflicts against current main.
• Regenerate/check OpenAPI artifacts after the conflict resolution.
• Attach screenshot/recording evidence for the frontend-touched surface, or remove the frontend touch if it is not needed.

Validation expected:

• Re-run npm run test:ci.
• Confirm npm run ui:openapi:check passes after regeneration.

[JSONbored]

@MkDev11 the current branch is clean against main and CI is green, but it conflicts with #219 since it just landed.

Required change:

• Rebase/regenerate after the #219 merge-order decision, especially around agent/orchestrator tests and OpenAPI artifacts.

Validation expected:

• npm run test:ci
• npm run ui:openapi:check
• npm run build:mcp

[JSONbored]

@MkDev11

A few notes:

• The card shape is useful: whyNow, blocker grouping, maintainer friction, expected impact, and rerun guidance make agent actions much easier to audit.
• Public-safe variants are tested separately from private planning text, which is the right boundary for this feature.
• OpenAPI and the packaged MCP text output were updated with focused coverage.

No code changes requested.