feat(review): add a global cross-repo blended contributor trust score

[JSONbored]

Summary

• computeContributorGateEval/contributorFairnessFlags only ever scored a contributor per-(login, project); this adds computeBlendedContributorGateEval/contributorGlobalFairnessFlags, which pool the same underlying prediction/outcome counts across every repo a login has touched into one volume-weighted accuracy figure (not an average of each project's own precision, so a login mostly active on one high-volume repo isn't distorted by a thin-sample row elsewhere).
• Wires the blend into getContributorTrustProfile (blendedGateAccuracy), both internal /v1/internal/fairness/contributors* routes, and a new operator-dashboard tile — counts-only, same bearer-gated/internal-only posture as the existing per-project data.
• Fixes a real bug in backfillContributorGateHistory: it bound nowIso() instead of the source review_audit row's own created_at, so a backfilled row silently claimed the decision happened the moment the backfill ran instead of when it actually happened.
• Adds a structural import-reachability test asserting the whole per-login contributor-identity module family (including the new blended functions) is never reachable from a public-facing entry point (public-stats.ts, orb-collector.ts's exportOrbBatch).

Backfill data note

Verified against the live self-hosted DB: contributor_gate_history predictions are only reconstructable back to ~2026-07-03 (when gate_decision writes were fixed for self-host in a prior commit); ground truth (pr_outcome) goes back to 2026-06-20. The ~13-day window before 2026-07-03 has no predicted-decision data recorded anywhere and is not recoverable. Once this PR is deployed, I'll re-run the (now-fixed) backfill route to pull in the reconstructable ~2026-07-03→07-08 window.

Test plan

• npx tsc --noEmit clean
• All touched unit/integration tests green (137 tests across 6 files)
• 100% line/branch/function coverage on every touched source file (verified via lcov)
• npm audit --audit-level=moderate clean
• New privacy-boundary test confirms the contributor-identity module family is unreachable from public entry points

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.36%. Comparing base (0fd0c9b) to head (635cf54).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7711      +/-   ##
==========================================
+ Coverage   88.56%   89.36%   +0.79%     
==========================================
  Files          83       88       +5     
  Lines       20664    23323    +2659     
  Branches     3648     4506     +858     
==========================================
+ Hits        18302    20842    +2540     
- Misses       2184     2211      +27     
- Partials      178      270      +92     

Flag	Coverage Δ
shard-1	32.83% <89.18%> (?)
shard-2	42.23% <1.35%> (?)
shard-3	69.83% <20.27%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/api/routes.ts	95.10% <100.00%> (ø)
src/review/contributor-gate-eval.ts	100.00% <100.00%> (ø)
src/review/contributor-gate-history-backfill.ts	100.00% <100.00%> (ø)
src/review/contributor-trust-profile.ts	100.00% <100.00%> (ø)
src/services/operator-dashboard.ts	100.00% <100.00%> (ø)