feat(scoring): derive observed pending PR scenarios

[oktofeesh1]

Summary

• Derive observed pending-PR scenarios from cached GitHub pull request state.
• Keep user-supplied assumptions separate from GitHub-observed state in private branch analysis.
• Preserve the public packet boundary while adding regression coverage for the new metadata path.

What changed

• Persist draft, mergeability, and review-decision fields from the open-PR GraphQL supplement.
• Add private scenarios for approved or mergeable PRs landing and stale or closed PRs clearing.
• Wire contributor-wide cached PR context into local branch API, MCP, and agent analysis.
• Extend OpenAPI schemas and focused unit coverage for persistence, scenario classification, and public packet sanitization.

Why

Closes #17. Local branch analysis can now model pending pull request state from cached GitHub data instead of relying only on manually supplied assumptions.

Validation

• npx vitest run test/unit/backfill.test.ts test/unit/db-parsers.test.ts test/unit/local-branch.test.ts test/unit/scoring.test.ts
• npm run test:ci
• git diff --check
• Codex Security diff scan completed locally with no reportable security findings.

Notes

• Scenario output remains private API/MCP context.
• Public PR packet sanitization continues to reject private account-sensitive language.

[JSONbored]

#57 feat(scoring): derive observed pending PR scenarios
action: merge
required:

• None obvious. Good scoreability projection work with validate passing.