feat(miner-foundation): extract reward-risk scoring into gittensory-engine (#2281) - #3985

Summary

Extracts the deterministic reward/risk reasoning signals out of src/signals/reward-risk.ts into packages/gittensory-engine/src/reward-risk.ts, so the gittensory-miner can rank candidate work locally with the same logic the maintainer-side gate computes. Moves buildRepoRewardRisk, buildContributorRewardRiskStrategy, buildMaintainerNoiseReport, buildPullRequestReviewability, rewardRiskFreshnessInternals, and every public type, and re-exports them from the engine barrel.

src/signals/reward-risk.ts becomes a shim that imports the engine implementation via its relative source path (../../packages/gittensory-engine/src/reward-risk.js) — matching the merged #2276/#2278/#2282 shims, not the published @jsonbored/gittensory-engine specifier — so no tsconfig path, vitest alias, or root dependency is introduced.

Closes #2281.

Why a wrapping shim instead of a pure re-export

Unlike the earlier self-contained extractions, reward-risk sits on top of the maintainer signal stack in src/signals/engine.ts (buildRoleContext, buildLaneAdvice, buildCollisionReport, buildQueueHealth, buildRepoFitRecommendation, buildContributorIntakeHealth, buildPullRequestReviewIntelligence) plus isFailingCheckSummary from src/signals/local-branch.ts. Those builders are not extracted yet and are far too large to port under the size cap, and the engine package must never import from src/. So the engine module takes them as an injected RewardRiskEngineDeps, and the shim binds the real src builders and threads them in — every existing importer keeps calling the four builders with their original signatures. Once those builders gain engine homes, a follow-up can drop the injection and collapse the shim back to a plain re-export.

The injected builders bind with no casts: their argument records are wider than (assignable to) the engine's mirror types, and their richer return types are covariantly assignable to the narrowed views the module reads. The engine-side types live in packages/gittensory-engine/src/types/reward-risk-types.ts (hand-kept mirrors, same pattern as predicted-gate-types.ts); the record mirrors are full verbatim copies because the reward-risk tests build those records as inline object literals. The real runtime objects pass straight through the injected builders, so behavior is identical to the pre-extraction file.

Coverage

Because the module is new to the engine package, codecov/patch measures every branch — including a handful of deterministic tie-break / defensive branches the pre-existing suite never exercised. test/unit/reward-risk-engine-branch-coverage.test.ts drives each of them (the fit.opportunities map, the analysisRank/topActions localeCompare/ACTION_RANK ties, the maintainer non-low-queue readiness score, both reviewChurnRisk tiers, and the equal-multiplier label sort). The one genuinely unreachable branch — the secondary action-rank presentation tie-break — is hoisted into its own statement and /* v8 ignore */-suppressed (the prior inline ignore did not suppress it). The engine module is now 100% branch / line / function.

Test plan

• npm run typecheck (exit 0) — and again with packages/gittensory-engine/dist/ moved aside (resolves via source, not a stale build)
• npm run test:coverage (11190 passed; engine reward-risk.ts 321/321 branches, 180/180 lines, 67/67 functions; shim 100%)
• npm run ui:typecheck, npm run ui:lint (0 errors), npm run ui:test (71)
• npm run rees:test (1189)
• git diff --check clean