test(agent): add public/private snapshot serialization fixtures

[JSONbored]

Parent roadmap: #127
Parent phase: #269
Parent epic: #270

Goal

Lock down the sanitizer and serialization contract for decision snapshots before richer snapshot fields are published through MCP, API, app, or GitHub surfaces.

Requirements

• Add focused fixtures for public, private/authenticated, and mixed snapshot payloads.
• Assert that public serializers exclude private reviewability, private scoreability, reward estimates, wallet, hotkey, raw trust, and local source context.
• Cover API/MCP-facing serialization where snapshot data becomes machine-readable.

Acceptance criteria

• Public snapshot serialization is fail-closed for sensitive fields.
• Private/authenticated serialization remains explicit and test-covered.
• The tests can fail future broadening of snapshot output before public leakage reaches GitHub surfaces.
• This is not an autonomous PR bot and not public scoring.

Validation expected

• Targeted snapshot serializer fixture tests.
• npm run test:ci.

[JSONbored]

Closing — the public/private snapshot serialization fixtures exist in test/unit/recommendation-snapshots.test.ts: "serializes only public-safe envelope fields" (line 18) and "never serializes private evidence summaries, assumptions, or warnings into the envelope" (line 198), asserting against the forbidden public-term set. Sibling children #281/#282/#284/#285 are already merged.