fixtures: add a fully in-contract safe replay fixture with test evidence

[sjh9714]

The safe PR zoo (fixtures/safe-pr-zoo/) shows PRs that should pass. We have agentic-reviewed-prompt, workflow-pinned-containers, and workflow-pinned-reusable-workflow — but none demonstrates the happy path of the contract workflow: an agent PR that declares a mergewarden-contract, stays entirely inside its allowed_paths, and includes the matching test changes required by a high_risk_paths rule with require_tests. This is the exact 'good agent PR' we want people to aim for, so it deserves a fixture.

Task

Add fixtures/safe-pr-zoo/in-contract-with-tests/ containing:

• fixture.json — a PR that modifies a high-risk source path and its matching test path (e.g. src/auth/session.ts + test/auth/session.test.ts).
• pr-body.md — a valid mergewarden-contract whose allowed_paths cover both files.
• mergewarden.yml — a policy with a high_risk_paths area that sets require_tests for the source path.

It must replay to a pass decision with zero warning/error findings.

Where to look (copy these patterns)

• Fixture shape: fixtures/safe-pr-zoo/agentic-reviewed-prompt/ (fixture.json + mergewarden.yml + pr-body.md).
• Contract block format: the <!-- mergewarden-contract ... --> example in the README.
• high_risk_paths + require_tests schema: the same README Minimal Policy block.
• Test assertions: packages/cli/test/replay.test.ts — add a case asserting the exact decision and empty active findings, following the existing safe-pr-zoo assertions there.

How to verify locally

pnpm install && pnpm --filter mergewarden build
node packages/cli/dist/main.js replay fixtures/safe-pr-zoo/in-contract-with-tests
# expect: decision = pass, 0 error / 0 warning
pnpm test   # your new replay assertion must pass

Done when

• The fixture replays to pass with zero active findings.
• A replay.test.ts case asserts the exact decision (per CONTRIBUTING.md: every fixture needs exact rule/severity/decision assertions).
• pnpm test, pnpm typecheck, pnpm lint, pnpm format:check all pass.

Slightly meatier than a docs change, but self-contained — a great way to learn the policy model. Ask here if the schema is unclear.