fix(upstream): count distinct affected repos across drift reports instead of summing

[philluiz2323]

Summary

summarizeRegistryHyperparameterDriftReports (src/upstream/ruleset.ts) aggregated the registry hyperparameter drift summary across all open drift reports but summed each report's affectedRepoCount instead of counting distinct repositories:

affectedRepoCount: sum(payloads.map((p) => p.affectedRepoCount)) || fallbackSummary.affectedRepoCount,

Each payload.affectedRepoCount is the unique-repo count within one report (new Set(repos).size). Summing across reports counts a repository once for every report it appears in, so a repo whose hyperparameters drift across several open reports is over-counted. The sibling fields in the same function (affectedFields, affectedSurfaces) are correctly deduplicated across reports with uniqueSorted(payloads.flatMap(...)) -- the repo count was the lone outlier. This value is returned as UpstreamStatus.registryHyperparameterDrift.affectedRepoCount from GET /v1/upstream/status, so dashboards/operators saw an inflated count. Closes #396.

Scope

• src/upstream/ruleset.ts -- the aggregator now unions repositories across reports instead of summing per-report counts. To union exactly (robust to the 100-event per-report cap, matching how affectedFields/affectedSurfaces union pre-cap payload lists), the stored drift payload now carries a pre-cap affectedRepos: string[]. This is kept on the internal payload only -- the public RegistryHyperparameterDriftSummary type and its OpenAPI schema are unchanged. Legacy payloads (predating the field) derive affectedRepos from their stored events, so older data still dedups rather than sums.
• test/unit/upstream-ruleset.test.ts -- new fail-on-revert test (two reports {x,y,z} and {z,w} yield 4 distinct repos, not 3 + 2 = 5); updated the malformed-payload assertion to the deduped value (3 -> 2) with a rationale comment.

Validation

• npx tsc --noEmit -- clean.
• npx vitest run test/unit/upstream-ruleset.test.ts -- 28/28 pass.
• Full suite -- 1065 pass, 1 skipped (one unrelated mcp-cli timeout under parallel load that passes 37/37 in isolation).
• Branch coverage 97.15% (above the 97% gate); ruleset.ts 98.89% branch / 100% line.

Safety

• Public API shape is byte-compatible: registryHyperparameterDrift still exposes the same fields with the same types; only the (now correct, smaller-or-equal) affectedRepoCount value changes when reports share repos.
• No new public field; affectedRepos lives only on the stored payload and is defaulted to [] for empty/legacy payloads.

Notes

The additive fields next to it (totalEvents, omittedEvents, highImpactCount) remain summed -- those count distinct events per report and are genuinely additive; only repositories recur across reports and must be unioned.

[JSONbored]

@philluiz2323 this is the right fix.

A few notes:

• The change connects the duplicate-risk reducer to the score preview path instead of only adjusting display logic.
• The unit test covers the collision count behavior directly.
• No code changes requested from me.

Validation expected:

• Current green CI is enough here.