fix(signals): wire duplicate-risk collision count into the duplicate_risk score blocker

[galuis116]

Summary

The score-preview gate emits a duplicate_risk reducer when input.duplicateRiskCount > 0 (src/scoring/preview.ts), but no production code ever set duplicateRiskCount — a grep across src/ returned only the type declaration and the consumer. So the reducer was dead code on every path; only test/unit/scenario-blockers.test.ts exercised it by passing the field directly to buildScorePreview.

The sibling reducer right above it, stale_work, is fed (buildLocalScoreInput sets observedStalePrCount). The two reducers were added together but only stale-work was wired to a producer. The duplicate-risk data the reducer needs is already computed on both producing paths and is even rendered into the contributor-facing "Overlap/WIP Check" packet — it was simply never converted into duplicateRiskCount for the score input. Closes #385.

Scope

• src/signals/local-branch.ts — thread duplicateRiskCount into buildLocalScoreInput (new param + returned field), derived from the already-available preflight.collisions as the count of high-risk overlap clusters relevant to the branch.
• src/signals/reward-risk.ts — add duplicateRiskCount: collisions.summary.highRiskCount to commonPreviewInput (the count already drives riskPenalty).
• test/unit/local-branch.test.ts — fail-on-revert test: a branch colliding with a high-risk overlap cluster now yields a duplicate_risk reducer in blockedBy.

No behavior change to any path where there is no high-risk collision: duplicateRiskCount resolves to 0 there, exactly as before.

Validation

• npx tsc --noEmit — clean.
• npx vitest run for the producer + consumer suites (local-branch, scenario-blockers, signals, signals-v2, decision-pack, agent-orchestrator) — all pass; the new test fails on revert.
• Branch coverage stays above the 97% gate.

Safety

• Purely additive: a new optional count threaded from data the system already computes. When no high-risk collision exists the value is 0 and output is byte-identical to before.
• No public schema / API surface change; the contributor-facing packet is unchanged (the collision was already rendered there).

Notes

Scoped to the two producing paths called out in the issue. Exposing duplicateRiskCount on the public scorePreviewSchema / MCP input (so external callers can supply it) is left out to keep this minimal and low-risk.