Make PR review verdicts deterministic and prior findings audited

[gontzess]

Problem

Three connected failures in the shared PR-review action, all observed on
ConductorOne/baton-axiomatic PR 249 after the Claude Code 2.1.280 /
claude-opus-5-5 upgrade (#126):

1. The agent stopped submitting the formal gh pr review verdict — a full day
   of runs posted zero reviews, leaving PRs with a quiet summary comment and
   no blocking signal. The ductone sister repo hit the same regression with
   Claude Code 2.1.187 and fixed it by moving verdict submission into CI.
2. The agent does not emit the marker reliably, so
   state detection failed closed: every run fell back to full review mode.
3. The prompt's 'skip anything already raised' rule plus 82 unresolvable
   stale threads (the Actions token is denied resolveReviewThread in every
   context tested, both orgs, public and private repos) let the reviewer
   dedupe everything into 'no new issues' — and a resolved thread was treated
   as if the underlying issue were fixed, which is not necessarily true.

Change

• submit-verdict-review.py (new, ported from ductone/github-workflows,
  judge/approve mode stripped): CI reads 'Blocking Issues: N' from the
  HEAD-bound sticky summary and submits --request-changes (N>0) or --comment
  (N==0). Baseline mode only — this reviewer never approves. Fails closed
  (nonzero) when no bound verdict exists, so a broken review is a loud red
  check instead of silent green.
• stamp-review-state.py (new, ported + adapted): CI stamps the full
  {last_reviewed_sha, base_sha, workflow_ref} marker with git HEAD after a
  successful agent step, so incremental mode and the verdict gate no longer
  depend on the model emitting the marker.
• resolve-outdated-threads.py: also writes .github/prior-findings.json (every
  bot finding, resolved or not, with thread state), and stops retrying
  resolveReviewThread after the first 'Resource not accessible by
  integration' denial instead of burning ~30s per thread.
• base-pr-review.md: mandatory prior-findings audit (Step 3) — thread state
  is not evidence of code state; each prior finding gets a still present /
  fixed / obsolete verdict derived from the current code, reported in a new
  'Prior Findings Re-check' summary section; Blocking Issues counts confirmed
  still-present priors so a PR with an unfixed blocking issue stays blocked.
  Wall-clock budget: post a provisional summary before going deep, bounded
  sub-agent fan-out. Verdict duty moved to CI; the agent no longer runs
  gh pr review.
• action.yml: wire the stamp + submit steps after a successful Claude step;
  harden claude_args (--setting-sources user --strict-mcp-config so the
  reviewed repo's agents/MCP/skills cannot hijack the review; hard-deny
  ScheduleWakeup/Cron* loop tools; drop Bash(gh pr review:*) and Skill from
  the allow-list).
• _gh.py (new, ported): shared resilient GitHub REST/GraphQL helper used by
  the two new scripts.

No permission changes: the workflow's existing pull-requests: write token
submits reviews as before; the resolveReviewThread denial is worked around
(read-only prior findings) rather than fixed with new credentials.

Verification

• python3 -m unittest discover -s .github/actions/pr-review/scripts -p 'test_*.py'
  — 44 tests pass (19 new: verdict parsing never approves, SHA binding,
  marker stamping fields, prior-findings collection, permission-denial
  short-circuit).
• action.yml and pr-review.yaml parse as valid YAML.
• End-to-end behavior cannot be exercised from this PR (the ruleset-required
  workflow runs from main); first post-merge run on a connector PR is the
  live check.

Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>