feat(miner): AMS contribution-eligibility filtering for discover

[JSONbored]

Summary

• Closes AMS contribution-profile: wire eligibility filtering into discover #6798, the final step of the AMS contribution-profile epic (epic: AMS per-repo contribution-profile discovery (labels, docs, agent-facing eligibility signals) #6793). AMS contribution-profile: local cache store + doctor integration #6797 (the cache store this depends on) already merged independently via feat(miner): add the ContributionProfile local cache store + doctor/migrate integration #7001 — this PR builds on that.
• Wires eligibility filtering into discover: resolves each target repo's ContributionProfile (cache hit when fresh, extracted live otherwise) and excludes a candidate missing a required eligibility label, carrying an exclusion label, or assigned to the repo's own owner, before ranking/enqueueing.
• Extends RawCandidateIssue with assignees — already present in the same GitHub list/search payload discover already fetches, no extra request.
• New contribution-profile-eligibility.js (matcher evaluation + conditional per-repo label-description fetch for the "rust E-easy" description-field case) and contribution-profile-resolution.js (cache-or-extract-live per repo).

Design notes

• Safe-default posture: a label rule only excludes when the profile actually resolved a matcher for it. A repo whose conventions couldn't be read (value: null) excludes nothing via that rule — discover never silently skips real work on an unreadable repo.
• Conflicting signals: a candidate that is both eligible and excluded resolves conservatively — exclusion always wins.
• Both --dry-run and the real run apply the same filtering; --dry-run never opens the cache, matching the existing policy-doc/policy-verdict cache convention.
• Excluded candidates and their reasons are surfaced in both --json and the human-readable summary (excludedByEligibility).

Test plan

• npm run typecheck — clean.
• npm run test:coverage (full, unsharded) — 978 files / 18314 tests passed, 0 failures.
• New unit tests for the eligibility matcher (29 tests), profile resolution (8 tests), and discover-cli integration (4 new tests covering real exclusion, dry-run, default cache open/close, and corrupt-cache degradation).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.74%. Comparing base (bd4c172) to head (418b1e7).
⚠️ Report is 8 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff            @@
##             main    #7034    +/-   ##
========================================
  Coverage   93.73%   93.74%            
========================================
  Files         690      692     +2     
  Lines       68591    68692   +101     
  Branches    18748    18748            
========================================
+ Hits        64293    64394   +101     
  Misses       3302     3302            
  Partials      996      996            

Flag	Coverage Δ
shard-1	43.73% <0.97%> (-0.10%)	⬇️
shard-2	36.88% <43.68%> (+0.04%)	⬆️
shard-3	33.13% <66.01%> (+0.09%)	⬆️
shard-4	34.39% <0.97%> (+0.42%)	⬆️
shard-5	31.74% <62.13%> (-0.52%)	⬇️
shard-6	46.02% <3.88%> (+0.22%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...over-miner/lib/contribution-profile-eligibility.js	100.00% <100.00%> (ø)
...pover-miner/lib/contribution-profile-resolution.js	100.00% <100.00%> (ø)
packages/loopover-miner/lib/discover-cli.js	100.00% <100.00%> (ø)
packages/loopover-miner/lib/opportunity-fanout.js	98.27% <100.00%> (+0.03%)	⬆️

[JSONbored]

Closing as superseded — #7024 independently implemented and merged this exact issue (#6798) while this PR was in progress, along with #6797 (#7001) before it. Both sub-issues are now closed.

One real gap remains: #7024 candidly scoped out assignee-exclusion as a follow-up ("a genuine second shared-file change... rather than half-wiring it"). I'll file a narrow, separate issue/PR for just that piece on top of the now-merged contribution-profile-filter.js, rather than carrying this duplicate diff forward.