feat(settings): derive contribution lanes from focus manifests

[JPette1783]

Summary

• Closes feat(settings): derive contribution lanes from focus manifests #297: compiles focus manifest inputs into clear contribution lanes contributors and repo owners can use to plan work before touching any files
• Adds ContributionLanePreference, ContributionLanes types and deriveContributionLanes() to src/signals/focus-manifest.ts
• All output is deterministic, explainable, and public-safe — no scoreability, reviewability, reward/risk, wallet, hotkey, or raw trust context in any field

Closes: #297

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck — clean
• npm run test:coverage locally — 788 pass (1 skipped); pre-existing Windows failures confirmed on main before this branch; coverage stays above 97%
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• UI/MCP/worker checks not applicable — this PR touches only src/signals/focus-manifest.ts and its test file

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (not applicable)
• API/OpenAPI/MCP behavior is updated and tested where needed. (not applicable — no public API surface changed)
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. (not applicable)
• Visible UI changes include screenshots or a short recording. (not applicable)
• Public docs/changelogs are updated where needed. (not applicable)

Notes

Lane derivation logic:

Manifest field	Effect
wantedPaths.length > 0	directPrLane: "preferred"
issueDiscoveryPolicy: "encouraged"	directPrLane: "discouraged", issueDiscoveryLane: "preferred"
issueDiscoveryPolicy: "discouraged"	issueDiscoveryLane: "discouraged"
issueDiscoveryPolicy: "neutral"	issueDiscoveryLane: "neutral"
linkedIssuePolicy: "required"	Adds "Link a tracked issue before opening a PR." to validationExpectations and "Issues must be linked to a PR before it is opened." to issueEntryGuidance
linkedIssuePolicy: "preferred"	Adds softer hint to both
testExpectations	Passed through after isFocusManifestPublicSafe filter
publicNotes	Included in prEntryGuidance after isFocusManifestPublicSafe filter
maintainerNotes	Never appears in any output field

Test coverage (45 total, 16 new):

• 15 fixture tests covering every derivation branch
• 1 property-based sanitizer test (400 random manifests, seeded LCG) verifying all text fields pass isFocusManifestPublicSafe

[JSONbored]

@web-dev0521 this needs a rebase before review can continue.

A few notes:

• The contribution-lane derivation is in the right settings/focus-manifest area.
• The branch conflicts in both implementation and tests.
• There are multiple focus-manifest PRs open, so this needs to land against the current shape deliberately.

Required changes:

• Rebase on current main.
• Resolve src/signals/focus-manifest.ts and test/unit/focus-manifest.test.ts.
• Re-run the focused focus-manifest test file.

Validation expected:

• Focused focus-manifest tests
• npm run typecheck
• Full CI green

[JPette1783]

@JSONbored , Updated.
Thank you!