feat: add contributor evidence graph

[grnlemon]

Summary

• Closes feat(agent): build contributor evidence graph snapshots #93.
• Add a bounded contributor evidence graph that combines official Gittensor contributor data, mirror issue evidence, and GitHub cache fallbacks with source/freshness provenance.
• Persist the graph in contributor evidence, signal snapshots, decision packs, and compact agent context snapshots without exposing private maintainer or scoring details.
• Refresh the OpenAPI/UI schema surface and add regression coverage for source precedence, maintainer-lane separation, stale fallback handling, caps, determinism, and sanitizer boundaries.

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None. npm run test:ci passed after rebasing onto current main; coverage summary reported 99.03% statements, 97.05% branches, 98.11% functions, and 99.62% lines.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include screenshots or a short recording.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• No visible UI changes; UI build only refreshes the generated OpenAPI public spec.
• Maintainer-lane relationships are kept separate from outside-contributor totals, and mirror-only solved issues do not inflate valid solved evidence.
• Graph label/path edges are constrained to included repo nodes so capped graph output stays internally consistent.

[JSONbored]

@MkDev11 this looks ready.

A few notes:

• The evidence graph is wired through the queue/decision-pack path rather than being a detached helper.
• The OpenAPI artifact was regenerated with the schema changes.
• The tests cover graph construction and integration points instead of only snapshotting shape.
• No code changes requested.

Validation expected:

• Current GitHub checks are green.