feat(control-panel): add agent run history and evidence viewer

[JSONbored]

Background

Gittensory recommendations need to be inspectable. Users should be able to see why an agent run produced a recommendation and which evidence/ruleset supported it.

Goal

Show MCP/API/GitHub agent runs, ranked actions, evidence, freshness, ruleset snapshots, and public/private output status.

Current Behavior

Agent outputs exist, but historical runs and evidence are not presented as a user-facing audit trail.

Desired Behavior

Users can inspect recommendation provenance, stale data, and public/private boundaries from the control panel.

Implementation Requirements

• Expose run history scoped to authorized actors/repos.
• Show ranked actions, evidence citations, freshness, and ruleset snapshot IDs.
• Mark stale or degraded data clearly.
• Do not reveal another user’s private run data.
• Support GitHub-command, MCP, and API run surfaces.

Public/Private Output Boundaries

Public GitHub output must never include wallets, hotkeys, payout/reward estimates, raw trust scores, public score estimates, private reviewability, private scoreability context, or farming language. Private API/MCP/control-panel surfaces may show authenticated scoreability, blockers, projections, and evidence, but must not claim guaranteed payout outcomes.

Acceptance Criteria

• Users can inspect why Gittensory gave a recommendation.
• Evidence is cited to snapshots or GitHub/Gittensor sources.
• Stale or degraded data is visible.
• Public/private boundaries are clear.
• Tests cover missing evidence, stale snapshot, and unauthorized run access.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, source-upload safety, public/private boundaries, or telemetry privacy.
• MCP/local tooling must prove source contents are not uploaded when local metadata is involved.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.