Publish full review reports when reviews complete

[gontzess]

Summary

• Publish a new full report at review completion instead of repeatedly editing a buried completed summary.
• Keep completed reports separate from model-owned working output. Preserve the previous report on incomplete or failed attempts.
• Link the explicit commit-bound formal review to the new report, then mark publication complete and collapse only older owned output while retaining its body and permalink.

The baseline policy is unchanged: blockers produce REQUEST_CHANGES; zero blockers produce neutral COMMENT, never APPROVE. Model/action versions, named-secret wiring, permissions and logging boundaries are unchanged.

Publication safety

Publication is an ordered multi-request operation, not an atomic transaction. Reports remain pending until their required formal review exists. Same-attempt retries reconcile the exact report, reviewed commit and submitted result; they do not recreate deleted/dismissed historical reviews or retire a newer report. Ambiguous creation responses are reconciled after a single transport attempt rather than blindly retried. Completion retains the original reviewed snapshot. Older reportless attempts cannot reclaim output already consumed by a later completed review; actual attempt-start time, not numeric run IDs, determines obsolescence.

A formal review may already exist if the subsequent completion-marker update fails. The report remains pending, prior useful output remains, and a same-attempt retry can finish the transition. Cleanup failures are non-destructive warnings.

New comment/review creation provides normal GitHub activity; inbox/email delivery still depends on subscription settings.

Verification

• Focused action suite: 134 tests passed.
• Independent mutation audit: 89 added/changed tests have recorded breaking mutations; removed change-detector tests are excluded.
• Stateful publisher smoke: 38 checks passed, including response-loss recovery, replay, explicit commit/event/link binding and preservation before replacement.
• Independent source review accepted the corrected candidate, including replay ownership, Unicode headings and original-base preservation.
• Action YAML parses successfully.
• Final-candidate consumer validation confirmed a new full report, explicit reviewed-commit link, matching commit-bound REQUEST_CHANGES, and post-success collapse of the previous report and exact working comment.
• A stale-head rerun failed before the agent ran: no new comment or host-owned verdict, and the existing completed report remained byte-identical.
• GitHub-rendered HTML confirmed the report links and collapsed prior body. An authenticated browser session was unavailable, so no visual or notification-delivery proof is claimed.
• Cancellation experiments raced publication; a cancelled run is not evidence that no review was published. The failed-attempt preservation claim uses the separate stale-head refusal above.

Retains the review-quality and prior-finding safeguards delivered in #129.

Rewritten-history regression follow-up

Real temporary Git histories and mocked GitHub comparison boundaries cover changed-base rebases, same-base squash/amend/force-push comparisons, unavailable prior commits, retained bot findings, and stale checkouts. The existing full-review fallback policy is unchanged. New controls were mutation-verified, including under an inherited PR_HEAD_SHA to prevent a masked checkout test. Previously local transport response-loss tests are now included in the branch. No reviewer runtime logic changed in this follow-up.

Current GitHub checks are self-review skips; the test counts above are local execution evidence, not claims that skipped checks ran tests.