Rework pr-reviewer workflow around suggestions

[aram356]

Summary

• Reworks the pr-reviewer agent around a single review pass that posts GitHub review comments and user-approved suggestion blocks, instead of pushing fixes or opening a stacked fix-up PR.
• Adds explicit PR, branch-remote, and branch-local modes with private review refs, merge-base-aware diff handling, branch-only output, and a head re-check before submission.
• Tightens CI and submission behavior: required checks are classified from gh pr checks --json buckets, failed required CI becomes a blocking body-level finding, pending reviews are preserved unless the user chooses to delete them, and review payloads are built as strict JSON.

Changes

File	Change
.claude/agents/pr-reviewer.md	Replaces the previous fix-up-PR loop with a one-pass review workflow. Documents mode resolution, worktree setup, full changed-file reads, CI classification, finding triage, GitHub suggestion eligibility, scratch verification, verdict precedence, branch-only rendering, PR head drift handling, pending-review handling, and safe gh api review submission.

Closes

Closes #706

Test plan

This is a workflow/documentation-only change under .claude/agents/; no Rust or JS source is affected.

• git diff --check -- .claude/agents/pr-reviewer.md
• Mocked CI capture cases:
  • nonzero exit with JSON -> classify from JSON
  • exit 8 with no JSON -> pending/no-output note
  • nonzero exit with no JSON -> command/API/auth diagnostic
• cargo test --workspace - n/a
• cargo clippy --workspace --all-targets --all-features -- -D warnings - n/a
• cargo fmt --all -- --check - n/a
• JS tests: cd crates/js/lib && npx vitest run - n/a
• JS format: cd crates/js/lib && npm run format - n/a
• Docs format: cd docs && npm run format - n/a, file is outside docs/

Checklist

• Changes follow CLAUDE.md conventions
• No production code changed
• No secrets or credentials committed

[ChristianPavilonis]

Automated review by Yesman.

I found one blocking correctness issue in the updated pr-reviewer instructions. The PR adds a stale-head guardrail in Step 1, but Step 2 still says to enumerate changed files with git diff main...HEAD --name-only (.claude/agents/pr-reviewer.md, current line 59). Because that line is not part of the submitted diff, I could not attach this as an inline comment.

This should use the just-fetched PR head, not the reviewer worktree's local HEAD. Otherwise later passes can enumerate files from an old checkout, a fix-up branch, or another branch entirely, causing the agent to miss current PR changes before submitting a review. Please make it consistent with Step 1, for example git diff origin/<baseRefName>...origin/<headRefName> --name-only after fetching the base, or git diff main...origin/<headRefName> --name-only if main is intentionally fixed.

CI is mostly passing with some checks pending at review time.