feat(analytics): classify recommendation outcome sources

[mkdev5]

Summary

• Closes feat(analytics): classify recommendation outcomes #302.
• Add persisted recommendation outcome source classification so inferred lifecycle outcomes stay distinct from explicit feedback.
• Preserve explicit rejected outcomes when inferred reevaluation runs, and expose rejected/source counts in the private recommendation outcome summary/OpenAPI contract.

Scope Summary

This PR only touches the recommendation outcome persistence/schema path, private summary contract, generated OpenAPI JSON, and targeted regression fixtures. It does not add command-feedback route ingestion, role-aware rollups, UI behavior, dependencies, or release notes.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None. npm run test:ci passed locally.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

No visible UI, frontend, docs, or extension behavior changed. The generated OpenAPI JSON was updated and checked; screenshots are not applicable.

State / title	JPG/PNG evidence
Not applicable	No visible UI change

Notes

• Adds migration 0024_agent_recommendation_outcome_source.sql, avoiding the stale 0020 migration numbering that blocked the previous closed attempt.
• Existing persisted outcomes default to inferred.
• Inferred updates no longer overwrite an explicit outcome for the same recommendation action.

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#469 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[JSONbored]

@MkDev11 this is ready from my side.

A few notes:

• The migration is correctly sequenced as 0024 after current main.
• Explicit feedback is preserved when inferred lifecycle sweeps rerun.
• The private summary/OpenAPI shape is updated and covered by targeted tests.
• No code changes requested.