feat(agent): add recommendation snapshot ids

[bitloi]

Summary

• Closes feat(agent): persist recommendation snapshot ids #281.
• Adds a durable recommendationSnapshotId plus a public-safe recommendationSnapshot envelope to every persisted agent action emitted by the supported agent paths.
• Uses the existing persisted agent context snapshot id plus action id, avoiding a schema migration and keeping existing callers compatible.
• Threads the id through existing API/MCP/control-panel action payloads where recommendations are already returned.

Related: #311 overlaps this area but bundles #281-#285 plus migrations and replay APIs. This PR keeps #281 focused on the id/envelope only.

Scope

• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; global coverage stays at or above 97% for lines, statements, functions, and branches (aim for 98%+ branch coverage locally so CI variance does not fail near the threshold)
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Additional focused checks:

• npm run test -- test/unit/recommendation-snapshots.test.ts
• npm run test -- test/integration/api.test.ts -t "serves deterministic signal endpoints"
• npm run typecheck
• npm run test:ci

If any required check was skipped, explain why:

• None.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include screenshots or a short recording.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• No UI, migration, deploy, dependency, docs, or changelog changes.
• The public-safe envelope includes only id/context/action/target metadata and does not copy action payload, recommendation evidence, private scoreability, or replay provenance.
• Existing action payload fields remain readable; new callers can key on payload.recommendationSnapshotId.

[JSONbored]

@bitloi this is ready from my side.

A few notes:

• The snapshot ID behavior is narrowly scoped and avoids pulling in the broader replay/migration work.
• The branch is locally merge-clean against current main.
• No code changes requested.

Validation expected:

• Keep the current green CI run after any required branch update.