fix(security): omit private maintainer notes from branch guidance

[JSONbored]

Motivation

• Prevent leaking maintainer-private maintainerNotes into contributor-facing branch analysis responses and persisted snapshots, since maintainerNotes are documented as private review context and must not be emitted to non-maintainers.

Description

• Remove maintainerNotes from the contributor-facing FocusManifestGuidance shape and from both the empty and present guidance return values in src/signals/focus-manifest.ts so guidance objects no longer carry private notes.
• Remove manifestGuidance.maintainerNotes from the OpenAPI response schema in src/openapi/schemas.ts and regenerate the UI OpenAPI document at apps/gittensory-ui/public/openapi.json so the public contract no longer exposes the field.
• Add/adjust regression tests in test/unit/focus-manifest.test.ts and test/unit/local-branch.test.ts to assert maintainerNotes is absent from guidance and that serialized analysis/pr-packet output does not contain private notes while public notes remain rendered.

Testing

• Ran typecheck with npm run typecheck and it succeeded.
• Ran unit tests with npm run test:unit -- test/unit/focus-manifest.test.ts test/unit/local-branch.test.ts and all tests passed.
• Regenerated and verified UI OpenAPI with npm run ui:openapi and checked it with npm run ui:openapi:check; the generated OpenAPI no longer documents maintainerNotes and the check passed.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	39e7f9a	Commit Preview URL Branch Preview URL	Jun 01 2026, 10:30 PM

[dosubot]

Documentation Updates

1 document(s) were updated by changes in this PR:

For Maintainers

View Changes

@@ -119,7 +119,7 @@
 - **`linkedIssuePolicy`** (string: `"required"`, `"preferred"`, or `"optional"`) — Whether PRs must link to a tracked issue.
 - **`testExpectations`** (string array) — Free-form guidance on what test evidence the maintainer expects (e.g., "Run `npm test` locally before opening a PR").
 - **`issueDiscoveryPolicy`** (string: `"encouraged"`, `"neutral"`, or `"discouraged"`) — Whether the maintainer welcomes new issue-discovery reports or prefers direct fixes.
-- **`maintainerNotes`** (string array) — Private review context for the maintainer; never appears in public PR threads.
+- **`maintainerNotes`** (string array) — Private review context for maintainers. Can be defined in the manifest configuration file to document internal review context, but is **explicitly omitted** from guidance objects returned to contributors and is **never persisted** in snapshots. This field was removed from the `FocusManifestGuidance` response schema for security reasons to prevent leaking private maintainer context to contributors, since guidance responses are contributor-facing.
 - **`publicNotes`** (string array) — Public guidance for contributors; shown in packet "Next Steps" and decision-pack recommendations after sanitization.
 
 #### Example

^{How did I do? Any feedback?}