Demote passive collaboration notifications

[99Yash]

Summary

• Extend the sender-kind demotion floor so confident group/strong-service senders can demote action_needed to fyi only when the demand is structurally passive.
• Cover passive collaboration state transitions and GitHub PR/CI notifications derived from From/Cc metadata, not body content.
• Preserve real assignments, direct asks, intrinsic-stake/security/payment/access cases, urgent, GitHub security alerts, and direct no-reason notifications.

Prod verification

• Current prod action_needed: 250.
• ClickUp bucket: 88, all addressed To, so recipient position is not a useful ClickUp discriminator.
• Refined ClickUp activity split: 19 assigned-to-user, 35 ask/mention, 11 passive activity, 23 state transitions.
• Exact ClickUp state-transition predicate dry-run matches 23 current rows, all from Oliv AI <notifications@tasks.clickup.com>.
• GitHub notification bucket: 57 current action_needed rows from notifications@github.com.
• Exact GitHub structural predicate dry-run matches 55 rows: 34 author@noreply.github.com, 17 ci_activity@noreply.github.com, 4 state_change@noreply.github.com.
• GitHub dry-run excludes sampled issue-author notifications and security_alert@noreply.github.com advisories.
• Recent Railway logs showed no triage errors; sampled warnings were unrelated Voyage embedding failures.

Tests

• CI=true corepack pnpm --filter @alfred/api test -- test/triage/classify.test.ts (package script ran full API suite: 768 tests, 0 failures)
• CI=true corepack pnpm --filter @alfred/api check-types