fix(scoring): derive active years from GitHub contribution history

[martinbha]

Closes #90

Problem

GitFut already fetched one contribution collection per calendar year, but reduced those collections directly into a single lifetime total. The scoring pipeline then estimated active years from creation and push dates on personally owned repositories.

That estimate misses contribution years spent in organization-owned repositories and can also miss private or non-commit activity. The undercount affects the recent-spike threshold, PHY, legacy bonus, overall rating, and card finish.

Fix

• Request hasAnyContributions alongside the existing annual contribution totals without adding API requests.
• Preserve annual results until both lifetime contributions and active years have been calculated.
• Pass activeYears through the normalized GitHub payload and use it instead of owned-repository dates.
• Cap activity by inclusive UTC calendar years, including accounts created late in a year.
• Keep the existing availability policy: failed batches retry one year at a time, and any year that remains unavailable or missing becomes zero/inactive without failing the scout.
• Leave cache versioning and the two-hour TTL unchanged so cached cards refresh naturally.
• Mirror the same annual calculation and fallback behavior in the distribution sampler.

The committed aggregate distribution file is unchanged because rebuilding it requires a fresh multi-hour 20,000-account sampling run; the runner now produces corrected data on its next regeneration.

Tests

• Annual contribution activity differs from owned-repository years.
• Active contribution years are non-contiguous.
• Failed batches recover through individual annual requests.
• Individually unavailable and omitted years become zero/inactive.
• Expected totals and year counts are derived from scenario parameters rather than copied result literals.
• The corrected year count crosses the recent-spike decision boundary while the repository-derived count does not.
• An eligible GOLD card becomes IN-FORM when the recent-spike signal is enabled.
• Late-year account creation preserves every inclusive calendar year.

Validation completed with:

• 286 tests passing across 22 files
• TypeScript check
• Production build
• Repository-wide lint with no errors (12 existing warnings)
• Authenticated GraphQL schema check for hasAnyContributions
• Distribution sampler --check smoke test