Self-review as a supervisory control program; CI verifies instead of reviewing

[bigboateng]

Summary

• Adds boatstack/cmd/boatstack-reviewer, a supervisory-control review program built directly on the domain-neutral kernel (its first production consumer). The review loop runs locally: an untrusted proposer (coding agent or human) submits candidate findings under the admitted review policy, and every round passes deterministic admission — exact schema validation against .github/codex/review-output-schema.json, diff-anchor validation against the exact merge-base..head diff, committed-tree freshness binding, and a priority-weighted convergence measure (bounds calibrated from the last 30 PRs' mined review history in testdata/review_rounds.json).
• A converged loop seals .github/reviews/<instance>.receipt.json, bound to the receipt-excluded head tree so committing the receipt does not invalidate it. The receipt carries the full kernel receipt chain, the round trajectory, and the final review bytes.
• Removes the openai/codex-action CI reviewer entirely. The new review-verified workflow builds the verifier and deterministically checks the sealed receipt against the base-admitted policy — no model or API key in CI. Repository contracts updated accordingly; the kernel-runtime expectedFailure marker is now the permanent positive production-reachability assertion.
• Surface: resolve (state + instructions + exact submission disposition), submit, status, show (read a recorded review without resolving), seal, verify, reopen (human capability), recover, reset. Agent-facing walkthrough in docs/self-review.md.
• Wraps the loop in two Yield skill workflows (Go, skills/self-review and skills/self-review-solve), registered for Cursor, Codex, and Claude Code. self-review runs one review round and reports the verdict without changing code (it verifies afterwards that no tracked file changed); self-review-solve decides from the committed control state what is needed — fixes open findings in code, reopens a drifted converged instance, asks the human before reopening an escalated loop — then converges, seals, and commits the receipt. yskill doctor --test exercises both against a sentinel-switched scratch repository so testing never touches real review state.
• Dogfooded on itself twice. Generation 1 (reviewer program): two real findings, fixed with regression tests, converged. Generation 2 (yield skills, driven end-to-end through the skills themselves): three real findings in the new workflow code (untracked-file gates diverging from the reviewer's worktree law, an impossible fix requirement when findings were pre-fixed, and a candidate transport that could hit the platform argument-size cap), all fixed, converged 12 → 0, and the solve skill sealed and committed the receipt in this PR.

Test plan

• go test ./cmd/boatstack-reviewer — program law, calibration fixture, admission soundness/completeness, stall law, full loop e2e, stale/dirty refusals, escalation + human reopen, tamper/forgery/bypass rejection, bounds-drift rejection, recovery, CLI verify/show/resolve
• go test ./flow/standard — source inventory registers the reviewer's writer and command boundaries
• yskill doctor skills/self-review --test and yskill doctor skills/self-review-solve --test — deterministic fixture runs against a scratch repository, including the untracked-file regression
• Full Python repository-contract suite (60 tests), re-run with the skills and adapters present
• Live end-to-end: both skills driven for real on this branch (review round with findings, fix commit, closing review, seal); verify --base origin/main --head HEAD passes all 8 checks against the committed receipt
• review-verified CI job passes on this PR (verifies the committed receipt)