feat(agent): add scenario input model and assumptions - #358

Fixes #286

Summary

• Adds src/scenarios/input-model.ts — deterministic agent scenario input model for repo-specific planning before individual simulations.
• Represents scenario type, repo config, issue/PR state, branch state, and signal buckets for facts, assumptions, estimates, and unavailable signals.
• Provides buildScenarioInput, parseAgentScenarioInput, serializeScenarioInputPublic, and serializeScenarioInputPrivate helpers safe for MCP/API use.
• Enforces metadata-only local branch inputs (assertScenarioLocalBranchInputSafe) and public-safe serialization (no wallet/hotkey/trust-score/payout/farming language).
• Does not implement ranking, strategy rendering, or autonomous PR behavior (advisory-only flags are fixed literals).

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

Verified locally with npm run test:ci on Node v24.15.0 (repo requires Node >= 22 per .nvmrc).

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• npm run test:raycast skipped — no Raycast package changes in this PR.

New tests: test/unit/scenario-input-model.test.ts — complete/partial/unavailable inputs, bucket kind validation, public vs private serialization, source-upload guard, forbidden-language property checks.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include screenshots or a short recording.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• Parent roadmap: roadmap: Gittensory ecosystem adoption v1 #127 / phase roadmap(phase 6): advanced contribution operating layer #269 / epic feat(agent): add repo-specific scenario simulator #271. Follow-up issues can map simulations (open PR pressure, score preview, etc.) onto this input model without duplicating field shapes.
• OpenAPI/MCP route wiring is intentionally deferred; this PR lands the shared model and serializers only.