Gather and stamp the pull request review from agentrepo pr #916

Problem

review.sh gathers what the independent reviewer reads for a pull request draft. It first validates the draft, then pins the draft, HEAD, the base commit and the merge base, and collects the commits, the changed paths, the complete diff and the template from those pinned commits. It binds the stamp to the draft's bytes, the branch name, HEAD, the base ref, that ref's commit, the merge base and the operator note, checks that nothing moved while the review ran, and then starts the reviewer. The stamp is the evidence publication verifies before pushing, so the gathering and the bindings are enforcement logic in shell.

Part of #588 and #323. Delivers in Go the behavior of packages/agents/source/skills/pr/shared/scripts/review.sh. This change adds Go behavior only and switches no caller.

Acceptance criteria

1. AC1: Given a draft, a branch and a base, when the review runs, then the stamp binds the draft digest, the branch name, HEAD, the base resolved to origin/<base> where origin has one, that ref's commit, the merge base and the operator note digest.
2. AC2: Given a stale local default branch, when the review runs, then the commit list and diff come from origin's base, so merged commits never count as landing.
3. AC3: Given a missing or empty draft, a draft with any validator finding, a detached HEAD, an unborn branch, a draft without a base, a base naming no branch or a base with no merge base, when the review runs, then it exits non-zero with the shell's message and starts no reviewer, and a draft with findings is rejected before anything else is gathered.
4. AC4: Given a branch, when the review runs, then the reviewer's inputs hold the draft as it was when copied, the range, the commits since the merge base, the changed paths, the full diff as text (no external diff program, no text conversion, no rename detection, no file shown as binary) and the template as committed at HEAD, all taken from the pinned commits.
5. AC5: Given changed paths with an empty diff, when the review runs, then it refuses, saying the content is hidden.
6. AC6: Given an operator note file, when the review runs, then the reviewer receives it and the stamp binds its digest; given a path that is not a file, then the run refuses.
7. AC7: Given the draft, the branch name, HEAD, the base ref or its commit, or the note changes while the reviewer runs, when it ends, then no stamp is written; this includes checking out a different branch at the same HEAD.
8. AC8: Given repository policy, when the review runs, then the reviewer receives it with the policy-content freshness rules that refactor(agents): port trusted review policy and prompt assembly to Go #763 delivers, evaluated separately from the independently pinned base of the pull request, the credentials floor still applies, and the report prints the policy path, digest, status, ref and commit.
9. AC9: Non-functional: the reviewer stays read-only and bounded by the existing review deadline.

Scope and non-goals

Scope: validation before review, snapshot gathering, stamp bindings, the freshness check and the call into the shared reviewer runner.

Non-goal: the reviewer's criteria, the runner and the stamp format, which #769, #771 and #763 own. Non-goal: changing what the stamp binds. Non-goal: switching the shell caller, which child 12 does; until then the shell review runs as today and keeps invoking the shell validator, so validation is preserved in the intermediate state.

Approach

Meet AC1 to AC9 with failing table-driven cases first, with a stub reviewer and scratch repositories, and compare the stamp fields and snapshot files with the shell's on the same fixtures, except where the policy-freshness correction of #763 intentionally differs. The shared snapshot, stamp and reviewer code is consumed as delivered by #769, #771 and #763; this child waits for them.

Dependencies

Blocked by: #910, #911, #912, #769 (snapshots and stamps), #771 (reviewer execution), #763 (trusted policy and prompt, carrying the correction from #776), #753 (protection of new Go enforcement paths).

Prerequisite: #321 (harness context).

Size

M. One pull request. Estimated under 600 changed code lines with tests.

Verify plan

• AC1, AC2: Go tests over scratch repositories with a stale local base, comparing stamp fields with the shell's.
• AC3, AC5, AC6: table-driven refusal cases with messages, including a draft with one validator finding.
• AC4: tests compare each snapshot file with the shell's on the same fixture, with an attribute that would change the diff.
• AC7: a test that moves each bound value from inside the stub reviewer, including checking out another branch at the same HEAD; tests/skills/agent-pr/checks.bats is the oracle for the branch case.
• AC8: tests with a policy file on a trusted ref and the credentials-floor text in the prompt, plus a case where policy freshness and the pinned base differ.
• AC9: a test asserts the reviewer is invoked with the read-only settings and the deadline.
• Go tests run in the existing Go CI on macOS, Linux and Windows.
• Definition of done: D1 each AC is verified at the merged head, with the commands and results cited in the pull request's Verification. D2 an independent review approves the exact merged head, and every finding has a recorded disposition. D3 required checks pass with no gate loosened. D4 the leak scans the repository specifies are clean, and every post made for this work passes the per-post leak review before it is posted. D5 every commit is signed. D6 the documentation matches the change or the Verification says why there is no impact. D7 every commit has an Assisted-by trailer and the pull request has the provenance:agent-assisted label. D8 the pull request stays within the size limits. D9 follow-ups are filed as issues and listed under Related. D10 the merge closes the issue through a closing reference, the board shows Done, and the final Status: comment names the merge commit.

Risks

A stamp that binds less than the shell's would let a moved base or a switched branch publish under an old review. The AC1 and AC7 cases are the control. Undo: revert the change; nothing calls the Go review yet and the shell reviews and stamps as before.

Operator authority

None.