feat(settings): generate repo onboarding pack preview for accepted repos

[kiannidev]

Fixes #248

Summary

• Adds a repo policy compiler (compileRepoPolicyCompilerOutput) that normalizes focus-manifest policy into structured output for onboarding-pack generation (feeds feat(settings): add repo policy compiler for focus manifests #277 → feat(settings): generate repo onboarding pack for accepted Gittensory repos #248 without duplicating manifest parsing).
• Wires preview-only onboarding packs for accepted (registered) repos via GET /v1/repos/{owner}/{repo}/onboarding-pack/preview (maintainer / owner / operator roles).
• Pack content includes contribution lanes, label policy, validation expectations, readiness warnings, maintainer expectations, and public-output boundaries; previewMarkdown is sanitized and publication remains preview_only / allowed: false.
• Extends test/unit/onboarding-pack.test.ts and adds test/unit/repo-policy-compiler.test.ts for compiler→pack pipeline, sanitizer boundaries, and registered-repo gating.

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

New / updated tests: test/unit/onboarding-pack.test.ts, test/unit/repo-policy-compiler.test.ts.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include screenshots or a short recording.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• Parent phase: roadmap(phase 3): repo owner intake console #236. Cross-link: repo policy compiler feat(settings): add repo policy compiler for focus manifests #277.
• API-first preview surface; no control-panel UI in this PR.
• Depends on focus-manifest policy compilation in src/signals/focus-manifest.ts (on main).

[JSONbored]

@kiannidev this looks mergeable to me.

A few notes:

• The preview endpoint is connected to the registration-readiness path and is represented in OpenAPI.
• The policy compiler coverage is the right validation layer for this change.
• No code changes requested from me; merge after the required review gate clears.

Validation expected:

• Current green CI is sufficient.