fix: buildSubmissionPacket silently drops required safety/privacy notes from the generated PR draft

[JSONbored]

Goal

Make buildSubmissionPacket's generated PR-draft text include the safety/privacy notes the submitter actually entered.

Why this matters

For risk-bearing categories, submission is blocked without these notes — but the generated draft text a contributor copies into their manual PR silently omits them, producing a draft that's inconsistent with what the site itself requires.

Current behavior

• apps/web/src/lib/submission-spec-lib.ts, buildSubmissionPacket (lines 375-391):

  export function buildSubmissionPacket(category: Category | "", data: Record<string, string>): string {
    const spec = category ? SUBMISSION_SPEC[category] : null;
    const fields = spec?.fields ?? COMMON;
    return fields
      .filter((field) => data[field.key]?.trim() || field.key === "category")
      .flatMap((field) => [...])

• safety_notes and privacy_notes are collected from the user in apps/web/src/routes/submit.tsx (step 2, always rendered, and required for risk-bearing categories per that file's preflight()), but neither key appears in any SUBMISSION_SPEC[...].fields array.
• Since buildSubmissionPacket only emits keys present in spec.fields, the generated draft text — used verbatim as the manual-PR body whenever siteConfig.submissionGateUrl is unset (submit.tsx:191) and also shown/copied to the user (submit.tsx:125-128,528-541) — omits the safety/privacy notes entirely.
• No test file exists for submission-spec-lib.ts.

Desired behavior

SUBMISSION_SPEC's field lists for risk-bearing categories (mcp/skills/hooks/commands/statuslines) include safety_notes/privacy_notes, so the generated draft text always reflects what the submitter actually entered and what preflight() requires.

Scope

• apps/web/src/lib/submission-spec-lib.ts (SUBMISSION_SPEC field lists for the risk-bearing categories)
• a new focused test file for submission-spec-lib.ts

Out of scope

• submit.tsx's form UI itself (already collects the fields correctly)
• Non-risk-bearing categories' specs, unless they also collect these fields

Acceptance criteria

• PR includes Closes #<issue>.
• buildSubmissionPacket for every risk-bearing category now includes non-empty safety_notes/privacy_notes in its output when the caller provides them.
• A new test file for submission-spec-lib.ts covers this.

Quality evidence required in the PR

• No visual impact; include a before/after sample of the generated draft text for one risk-bearing category.

Validation

pnpm build
pnpm exec vitest run tests/submission-spec-lib.test.ts
git diff --check

[linear-code]

JSO-7320