fix(scoring): base open-PR threshold on merged history only

[philluiz2323]

Closes #454.

The open-PR spam gate (computeScoreCore) computed its concurrency threshold by adding the planned PR's own totalTokenScore to the contributor's established merged-history token score (existingContributorTokenScore). So previewing a single large PR inflated the contributor's own allowance for concurrent open PRs, even with zero merged history.

Example: existingContributorTokenScore: 0, planned totalTokenScore: 300, openPrCount: 3 → threshold min(30, 2 + floor((0+300)/300)) = 3, gate passes; with the planned PR excluded it is 2, gate blocks.

Changes

• Base the threshold bonus on existingContributorTokenScore only (established merged-history trust), not the in-flight PR's tokens.
• Add a test asserting the planned PR's tokens do not raise the threshold while merged history does.

Verification

• Full unit suite green (1243 passed). New test fails against the old code (old threshold 5 vs 2).

[gittensory]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#455 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[JSONbored]

Reviewed the patch and current CI state. The threshold now depends only on established merged-history token score, and the regression covers both no-history and with-history behavior. CI is green. No merge action taken.