feat(preflight): generate public-safe pr packets

[oktofeesh1]

Summary

• Generate a public-safe PR packet from local branch metadata only.
• Expose packet markdown in the local branch analysis response and MCP CLI packet output.

What changed

• Added prPacket.markdown with sections for summary, linked context, branch freshness, overlap/WIP checks, changed paths, validation, and next steps.
• Redacted local absolute paths from changed-file summaries and filtered sensitive contributor/review language from packet lines.
• Added a final local CLI sanitizer before non-JSON packet output prints server-provided markdown.
• Added regression coverage that rejects score, reward, wallet, hotkey, raw-trust, and private-reviewability language from non-JSON packet output.
• Updated the MCP package changelog under Unreleased.

Why

Contributors need a copy/paste PR packet that is safe to publish without exposing local machine paths, sensitive review context, or source contents. This keeps the workflow metadata-only and avoids accidental source upload while still giving maintainers the freshness, overlap, and validation context they need.

Closes #39.

Validation

• npm run test:ci
• npm run changelog:check:mcp
• GitHub validate check triggered on the latest pushed commit.

Notes

• Source upload remains disabled for this workflow.
• The packet is generated from local git and preflight metadata, not raw file contents.
• Package version remains 0.2.0; MCP package version bumps are release-tag driven through the mcp-v* publish workflow, while this PR records the CLI surface change in the package changelog.

[JSONbored]

PR #53 — request changes
feat(preflight): generate public-safe pr packets

Required changes:

• Wait for/trigger validate; GraphQL shows no validate check on the latest commit.
• Add a final local CLI sanitizer before printing server-provided packet markdown in non-JSON mode.
• Test that non-JSON packet output rejects score/reward/wallet/hotkey/raw-trust/private-reviewability language even if a fixture/server payload regresses.
• Confirm package changelog/version policy because this changes the npm CLI surface.

issues resolved