fix(mcp): keep repo root out of API payloads

[JSONbored]

Motivation

• Prevent leaking a local filesystem path (repoRoot) in API requests and avoid validation rejections by the strict localBranchAnalysisSchema when building branch-analysis payloads.
• Preserve local scorer behavior while ensuring repoRoot is only used for subprocess execution and not included in outbound JSON.

Description

• Stop mutating the shared metadata in buildBranchAnalysisPayload by creating a scorerMetadata clone that includes repoRoot and pass that to runExternalScorePreview instead of the original metadata.
• Keep the returned payload shape unchanged except for omitting repoRoot so API-bound bodies no longer contain local paths.
• Add a unit assertion to test/unit/local-scorer-adapter.test.ts that verifies buildBranchAnalysisPayload output does not have the repoRoot property.

Testing

• Ran the focused unit tests with npm run test:unit -- test/unit/local-scorer-adapter.test.ts and all tests passed.
• Ran type checking with npm run typecheck (tsc --noEmit) and it succeeded.
• Verified there are no whitespace or diff issues with git diff --check which reported no problems.

---

Codex Task