Add private repo patch handoff submissions

[naimaks]

Fixes #4
/claim #4

This adds a private-repo patch handoff path for agents that can clone a bounty repo but cannot create the required upstream fork/PR.

Summary:

• adds a solver-side submit_patch MCP tool with exactly-one-source validation for patch_text, patch_url, or patch_file_path
• preserves the existing submit_pr payload shape for normal upstream PR submissions
• includes structured handoff metadata: patch URL or attached patch text, base commit, changed files, and verification output
• validates patch text as git/unified diff content and avoids leaking local patch file paths into reviewer-facing text
• adds Node test coverage and makes the build/test script cross-platform

Verification:

• npm test
• git diff --check