feat(mcp): add miner planning prompts

[Lobster-0429]

Summary

• Closes feat(mcp): add miner planning prompts #293: adds MCP prompts for miner planning workflows guiding contributors through safe contribution decisions
• 4 prompts registered via server.registerPrompt() in src/mcp/server.ts
• Every prompt is advisory-only — each message explicitly instructs the agent not to create issues, PRs, comments, labels, closures, or merges
• No forbidden language (wallet, hotkey, seed phrase, raw trust, reward estimate, scoreability) in any description or returned message
• Adds test/unit/mcp-miner-prompts.test.ts (11 tests) with discovery fixtures and content safety assertions

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck — clean
• npm run test:coverage locally — 783 pass (1 skipped); pre-existing Windows failures confirmed on main before this branch; coverage stays above 97%
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• UI checks not applicable — MCP-only change, no UI surface changed
• npm run build:mcp and npm run test:mcp-pack require the local MCP environment; unit tests cover the server-side prompt registration and content

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (not applicable)
• API/OpenAPI/MCP behavior is updated and tested where needed. Prompt discovery tested via client.listPrompts() and client.getPrompt() with InMemoryTransport.
• Visible UI changes include screenshots or a short recording. (not applicable)
• Public docs/changelogs are updated where needed. (not applicable)

Notes

Prompt inventory:

Name	Workflow	Tools used
gittensory_select_contribution_issue	Issue selection	get_issue_quality, explain_repo_decision
gittensory_draft_contribution_pr_packet	PR packet drafting	get_repo_context, get_decision_pack
gittensory_preflight_contribution_branch	Branch preflight	get_repo_context, explain_repo_decision
gittensory_plan_cleanup_first	Cleanup-first planning	monitor_open_prs, get_decision_pack

Test structure (11 tests):

• Discovery (5): all 4 prompts discoverable, gittensory_ prefix, stable inventory, descriptions forbidden-term-free, unknown prompt throws
• Content safety per-prompt (4): each prompt's returned messages individually checked against FORBIDDEN_PROMPT_TERMS and FORBIDDEN_REQUEST_PATTERNS
• Advisory-only (1): all 4 prompts verified to instruct against autonomous GitHub writes
• No secret requests (1): message text must never mention wallet, hotkey, token, seed phrase, private key, or password

[JSONbored]

@web-dev0521 this is ready from the current-main diff.

A few notes:

• The miner-planning prompts are scoped to the MCP prompt surface and covered by tests.
• The main thing to watch is merge order with the adjacent MCP prompt/resource PRs.
• This can land first, and the overlapping prompt PRs should rebase after it.

No code changes requested.

Validation expected:

• Keep the MCP/unit suite green through merge.