Commit density per repo inside the hack window #3

Why

A repo whose commits cluster inside the 27 hour window is a hackathon repo regardless of its name. This is a discovery signal and the input to a commit heatmap.

In this repo today

github/history.py and github/repositories.py store window_commits and total_commits per repo, and linking/reconcile.py uses window_commits thresholds (MIN_WINDOW_COMMITS, MIN_LIKELY_COMMITS). We do not store first or last commit times or an hourly breakdown.

What to build

• Extend the commit fetch to compute first_commit_at, last_commit_at (UTC) and an hourly commit count for each hour of the window.
• Add the columns to repos in db.py, a RepoActivity Pydantic model, and fill them during scan.
• density = window_commits / total_commits, computed in one pure function.
• In reconcile.py, treat density >= 0.6 with at least the minimum window commits as a reason to keep a repo as a candidate project, and add commit_density to its discovered_via.

Acceptance criteria

• A fixture of 12 commits with 9 inside the window gives density 0.75 and the right hourly buckets (a unit test on the pure function).
• The new columns are filled after uv run hackproof scan.

See CONTRIBUTING.md for conventions.