fix: hub-highlights safety/privacy checks ignore safetyNotesList/privacyNotesList

[JSONbored]

Goal

Make hub-highlights-lib.ts's safety/privacy note checks recognize safetyNotesList/privacyNotesList, not just the scalar safetyNotes/privacyNotes fields.

Why this matters

Entries that document safety/privacy as a structured list are currently invisible to this file's stats and highlight-picking logic, undercounting real documentation coverage shown on real hub pages.

Current behavior

• apps/web/src/lib/hub-highlights-lib.ts, hubStats (lines 184-185): entries.filter((e) => Boolean(e.safetyNotes)).length / Boolean(e.privacyNotes).
• hubHighlights's "documented" pick (line 118): pickBest(entries, (e) => free(e) && Boolean(e.safetyNotes) && Boolean(e.privacyNotes), ...).
• Entry.safetyNotes/privacyNotes are scalar strings, but the registry also supports safetyNotesList/privacyNotesList array fields (apps/web/src/types/registry.ts:189-192).
• Every other place in the codebase that checks for safety/privacy note presence uses Boolean(entry.safetyNotes || entry.safetyNotesList?.length) — including apps/web/src/data/validators.ts:127-131 and the hasSafetyNotes/equivalent helpers used across compare/entry-detail lib files (one of which, entry-detail-command-center-lib.ts, has a comment explicitly noting it was fixed for this reason under fix: entry detail command center readiness checklist ignores its own hasSafetyNotes helper #5596). hub-highlights-lib.ts never received that fix.
• Real impact: this file backs the hub stat tiles and highlight picks rendered on apps/web/src/routes/$category.tsx, for.$platform.tsx, for.$platform.$category.tsx, tags.$tag.tsx, and api/github-stats.ts. An entry whose notes are list-only is undercounted in the "Safety notes"/"Privacy notes" tiles and can never win the "Safety + privacy documented" highlight pick.

Desired behavior

hub-highlights-lib.ts uses the same Boolean(entry.X || entry.XList?.length) pattern every sibling file already uses, for both safety and privacy notes.

Scope

• apps/web/src/lib/hub-highlights-lib.ts (hubStats, hubHighlights)
• focused tests

Out of scope

• Any file that already correctly checks both fields
• The underlying safetyNotesList/privacyNotesList schema itself

Acceptance criteria

• PR includes Closes #<issue>.
• An entry with only safetyNotesList/privacyNotesList populated (no scalar equivalent) is now counted in hubStats and eligible for the "documented" highlight pick.
• Existing scalar-only behavior is unchanged.

Quality evidence required in the PR

• No visual impact under existing data; include a before/after count for a fixture entry using only the List fields.

Validation

pnpm build
pnpm exec vitest run tests/hub-highlights-lib.test.ts
git diff --check

[linear-code]

JSO-7319