fix(signals): derive cache-only contributor outcome totals consistently

[philluiz2323]

Closes #380.

Summary

In buildContributorOutcomeHistory, the per-repo repoOutcomes are internally consistent (each repo keeps pullRequests >= merged + open + closed and issues = openIssues + closedIssues), and the totals already sum repoOutcomes for closedPullRequests / openIssues / closedIssues / solvedIssues. But the cache fallbacks for pullRequests / mergedPullRequests used registeredRepoActivity (a separate Math.max aggregate), openPullRequests used an unfiltered repoStats sum, and issues used registeredRepoActivity.issues with no official fallback. So for a cache-only contributor (no official Gittensor snapshot) the totals were internally inconsistent: pullRequests != merged + open + closed, closedPullRequestRate = rate(closed, pullRequests) could exceed 1, and openPullRequests was the only repoStats access not scoped to the subject login.

Scope

• src/signals/engine.ts — when official totals are absent, derive every PR/issue total by summing the same login-scoped, internally-consistent repoOutcomes (via a sumOutcomes helper), and compute issues as openIssues + closedIssues. Fixes the invariant, the out-of-range rate, and the login-scoping of openPullRequests in one consolidation.
• test/unit/signals-v2.test.ts — cache-only totals consistency + login-scoping test.

No schema, API, or public-surface changes.

Validation

npx vitest run test/unit/signals.test.ts test/unit/signals-v2.test.ts \
  test/unit/signals-coverage.test.ts test/unit/decision-pack.test.ts \
  test/unit/agent-orchestrator.test.ts                                       # 125/125
npx tsc --noEmit                                                            # clean
git diff --check                                                            # clean (no whitespace errors)

Branch coverage stays >= 97%. CI validate is green.

Safety

• Pure aggregation change scoped to the cache-only fallback path; the official-data path is unchanged in behavior except that issues is now openIssues + closedIssues (consistent with the per-repo definition) instead of a separate registeredRepoActivity value. No new external calls, tokens, or data surface.
• The new totals are derived from the already-computed, login-scoped repoOutcomes, so they cannot include another contributor's rows, and closedPullRequestRate is now bounded by a denominator consistent with its numerator.

Notes

• Reachable for any contributor without an official Gittensor snapshot (new/unranked contributors). closedPullRequestRate gates the >= 0.35 high-closure-risk / avoid-repo strategy thresholds, so the inconsistent rate could mis-classify a contributor.