feat(settings): feed policy output into onboarding pack previews

[bitloi]

Summary

• Closes feat(settings): feed policy compiler output into onboarding packs #299 by adding a stable buildRepoOnboardingPackPreview handoff from policy compiler output into contribution lanes, label policy, validation expectations, readiness warnings, and preview markdown.
• Keeps generated public onboarding text sanitized by reusing the focus-manifest public safety check, dropping unsafe public inputs without echoing their values, and keeping private owner context out of the public preview.
• Refreshes the UI MCP known-latest fallback from 0.3.0 to 0.4.0 because the current repo CI ui:version-audit compares it to the live npm dist-tag.

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• None. Full npm run test:ci passed locally.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include screenshots or a short recording.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• No onboarding pack UI, export flow, publication path, autonomous issue filing, autonomous PR creation, comments, labels, closure, merge, or public scoring surface is added.
• No screenshot is included because this does not add a visible UI workflow; the UI change is a one-line package-version fallback used by existing version copy.
• The MCP fallback refresh is isolated in its own commit so reviewers can separate it from the feat(settings): feed policy compiler output into onboarding packs #299 signal-layer work.

[JSONbored]

@bitloi this looks ready from my pass.

A few notes:

• The PR keeps #299 scoped to the stable onboarding-pack handoff instead of expanding into a full UI/export path.
• Unsafe public inputs are dropped and tracked without echoing unsafe values.
• The tests cover the sanitizer boundary and fallback behavior that matter for this phase.

No code changes requested from me.