feat(enrichment): add churn-hotspot + bug-density scorer analyzer - #1750

GitHub PR search returned zero authored/ hydrated pull requests, so no patch-level review is possible. The activity metadata shows 10 recently opened PRs across 4 repositories in the last few days, but titles and body lengths alone cannot prove safety. PR titles are predominantly documentation/glossary additions (taopedia-articles, gittensory runbook) and one UI feature (metagraphed-ui account page), yet without inspecting changed files, hunks, dependencies, CI scripts, or lifecycle hooks, we cannot rule out hidden malicious payloads, obfuscated code, or supply-chain tampering disguised as docs. The contributor also shows a 0 % merge rate (6 closed, 0 merged) and a burst of cross-repo activity (12 distinct repos in 7 days), which slightly elevates uncertainty. Because the evidence packet is too truncated to perform the mandatory mini-reviews of patch content, the verdict must be inconclusive.