feat(mcp): add structured output schemas for existing tools

[Lobster-0429]

Summary

• Closes feat(mcp): add structured output schemas for existing tools #291: adds MCP-native structured output schemas to 11 machine-readable tools so modern clients can validate and render Gittensory responses reliably
• Existing CLI JSON behavior and tool result shapes are unchanged — outputSchema is discovery metadata plus server-side validation only
• No schema declares wallet/hotkey/coldkey/financial property names, preserving public/private boundaries across surfaces
• Adds test/unit/mcp-output-schemas.test.ts (9 tests) for schema discovery, structured-content validation, and safety

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck — clean
• npm run test:coverage locally — 794 pass (1 skipped); pre-existing Windows failures confirmed on main before this branch; coverage stays above 97%
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• UI checks not applicable — MCP-only change, no UI surface changed
• npm run build:mcp and npm run test:mcp-pack require the local MCP environment; the api.test.ts integration tests (which call these tools with seeded data) pass, confirming schemas validate against real responses

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. (not applicable)
• API/OpenAPI/MCP behavior is updated and tested where needed. Output schemas are discoverable via tools/list and validated server-side on every tools/call.
• Visible UI changes include screenshots or a short recording. (not applicable)
• Public docs/changelogs are updated where needed. (not applicable)

Notes

Tools covered (outputSchema added):

Tool	Schema
gittensory_get_repo_context	repoContextOutputSchema
gittensory_get_burden_forecast	freshnessResponseOutputSchema
gittensory_get_repo_outcome_patterns	freshnessResponseOutputSchema
gittensory_get_issue_quality	freshnessResponseOutputSchema
gittensory_get_contributor_profile	contributorProfileOutputSchema
gittensory_get_decision_pack	decisionPackOutputSchema
gittensory_monitor_open_prs	openPrMonitorOutputSchema
gittensory_explain_repo_decision	explainRepoDecisionOutputSchema
gittensory_get_registry_changes	registryChangesOutputSchema
gittensory_get_upstream_drift	upstreamDriftOutputSchema
gittensory_local_status	localStatusOutputSchema

Schema design rationale:

• Declares documented top-level fields; complex/nullable/variant fields use a permissive type (z.unknown()) so validation never rejects a real response — the MCP SDK strips unknown keys and accepts them.
• All fields are .optional() because several tools return either a result payload or a { status: "not_found" } / refresh envelope depending on cache state.
• The MCP SDK validates structuredContent against the schema on every call; the full integration suite calling these tools passes, proving the schemas match real outputs.

Test structure (9 tests):

• Discovery (3): every covered tool exposes an object outputSchema; documented top-level properties present; full tool inventory preserved
• Validation (4): local_status, upstream_drift, registry_changes, repo_context return schema-valid structuredContent
• Safety (2): no output schema declares private financial field names; public tool structured content never leaks redacted financial keys

[JSONbored]

@web-dev0521 this is a useful contract-hardening change.

A few notes:

• Adding structured output schemas to existing MCP tools makes the interface easier to consume without expanding behavior.
• The test coverage is in the right place for the server contract.
• I do not see a current-main conflict.

No code changes requested.

Validation expected:

• Keep the MCP/unit suite green through merge.