fix(scoreability): wire duplicate-risk collisions into score preview blockers

[jonathanchang31]

Summary

This PR fixes issue #385.
The duplicate_risk scoreability blocker already existed in buildScorePreview, but production code did not pass duplicateRiskCount, so the blocker could only fire in direct unit tests.

This change wires high-risk duplicate/overlap collision counts into score preview inputs from production paths:

• local branch analysis
• repo reward-risk analysis

Now, when high-risk duplicate or overlapping work is detected, private scoreability surfaces include the duplicate_risk reducer blocker.

Related Issue

Closes: #385

Change Type

• Bug fix
• Scoreability logic
• Private signal correctness
• Regression tests
• Feature
• Refactor only

Real Behavior Proof

Before this change:

• buildScorePreview consumed duplicateRiskCount.
• No production producer set duplicateRiskCount.
• duplicate_risk could not fire in real local-branch or reward-risk flows.

After this change:

• A high-risk duplicate collision in local branch analysis produces:

  • scorePreview.blockedBy[].code === "duplicate_risk"

• A high-risk duplicate collision in reward-risk analysis produces:

  • currentPreview.blockedBy[].code === "duplicate_risk"

Validation

Ran locally on Node 22:

• npx vitest run test/unit/local-branch.test.ts test/unit/signals-coverage.test.ts test/unit/scenario-blockers.test.ts

  • Passed: 58/58

• npm run typecheck

  • Passed

• npm run test:unit

  • Passed: 1007/1007

• npm run test:integration

  • Passed: 35/35

• npx wrangler dev --local --ip 127.0.0.1 --port 8792

  • Worker started successfully
  • Observed: Ready on http://127.0.0.1:8792

Checklist

• Verified duplicateRiskCount was consumed but not produced
• Wired production local-branch path
• Wired production reward-risk path
• Added regression tests for production builders
• Typecheck passes
• Unit tests pass
• Integration tests pass
• Local worker startup validated
• No dependency installation needed

[jonathanchang31]

@JSONbored Could you plz review my PR?

[JSONbored]

@jonathanchang31 thanks for picking this up.

A few notes:

• The duplicate-risk issue is real, but fix(signals): wire duplicate-risk collision count into the duplicate_risk score blocker #387 now covers the same fix in a cleaner, narrower branch.
• Keeping both PRs open creates review noise and increases the chance of merging duplicate test/scoreability changes.

Required changes:

• I would close this PR in favor of fix(signals): wire duplicate-risk collision count into the duplicate_risk score blocker #387.
• If anything here is intentionally not covered by fix(signals): wire duplicate-risk collision count into the duplicate_risk score blocker #387, open a fresh follow-up with that smaller delta only.

Validation expected:

• A replacement should include focused validation for the behavior not already covered by fix(signals): wire duplicate-risk collision count into the duplicate_risk score blocker #387.