feat(review): emit the Step 3A fan-out as a generated workflow script

packages/cli/src/commands/review.test.ts

@@ -54,6 +54,7 @@ describe('reviewCommand', () => {
       'comment-status',
       'load-rules',
       'agent-prompt',
+      'emit-workflow',
       'build-test',
       'base-tree',
       'scratch-tree',

packages/cli/src/commands/review.ts

@@ -26,6 +26,7 @@ import { publishAssetsCommand } from './review/publish-assets.js';
 import { resolveAnchorsCommand } from './review/resolve-anchors.js';
 import { checkCoverageCommand } from './review/check-coverage.js';
 import { agentPromptCommand } from './review/agent-prompt.js';
+import { emitWorkflowCommand } from './review/emit-workflow.js';
 import { buildTestCommand } from './review/build-test.js';
 import { baseTreeCommand } from './review/base-tree.js';
 import { scratchTreeCommand } from './review/scratch-tree.js';
@@ -69,6 +70,7 @@ export const reviewCommand: CommandModule = {
       .command(commentStatusCommand)
       .command(loadRulesCommand)
       .command(agentPromptCommand)
+      .command(emitWorkflowCommand)
       .command(buildTestCommand)
       .command(baseTreeCommand)
       .command(scratchTreeCommand)
@@ -94,7 +96,7 @@ export const reviewCommand: CommandModule = {
       .command(cleanupCommand)
       .demandCommand(
         1,
-        'Specify a subcommand: run, parse-args, match-remote, meta, issue-context, fetch-diff, comment-body, fetch-pr, capture-local, plan-diff, repo-context, pr-context, comment-status, load-rules, agent-prompt, build-test, base-tree, scratch-tree, test-delta, drive, ab-drive, mock-provider, extract-step, script-lint, revert-hunk, resolve-anchors, check-coverage, cost-ledger, presubmit, test-efficacy, test-plan, findings, recover-findings, publish-assets, compose-review, save-artifact, submit, or cleanup.',
+        'Specify a subcommand: run, parse-args, match-remote, meta, issue-context, fetch-diff, comment-body, fetch-pr, capture-local, plan-diff, repo-context, pr-context, comment-status, load-rules, agent-prompt, emit-workflow, build-test, base-tree, scratch-tree, test-delta, drive, ab-drive, mock-provider, extract-step, script-lint, revert-hunk, resolve-anchors, check-coverage, cost-ledger, presubmit, test-efficacy, test-plan, findings, recover-findings, publish-assets, compose-review, save-artifact, submit, or cleanup.',
       )
       .version(false),
   handler: () => {

packages/cli/src/commands/review/agent-prompt.ts

@@ -1351,8 +1351,12 @@ function fetchedShaOf(report: PlanReport): string | undefined {
  * have any. Resolved against the process cwd, like every other use of
  * `worktreePath` here: the report stores it repo-relative and review commands
  * run from the project root.
+ *
+ * Exported for `emit-workflow`, which must probe the tree exactly the way this
+ * command's handler does: both paths build through `buildLaunch`, and a probe
+ * only one of them ran is a divergence in the briefs the two paths bake.
  */
-function worktreeResidueOf(report: PlanReport): WorktreeResidue {
+export function worktreeResidueOf(report: PlanReport): WorktreeResidue {
   const wt = report.worktreePath;
   if (typeof wt !== 'string' || !wt) return { paths: [], total: 0 };
   // Hand over the sha fetch-pr recorded: committing the contamination moves
@@ -2305,12 +2309,15 @@ export function findingsSection(
  * Build one agent's brief and launch prompt, write the brief beside the plan, and
  * return the key and the prompt for the caller to record and print.
  *
- * One body for both callers on purpose: the single-agent path and `--roster` must
- * emit byte-identical prompts for the same agent, because the delivery check
- * compares agents against records — a drift between the two paths would read as a
- * rewritten launch on a run that did everything right.
+ * One body for every caller on purpose: the single-agent path, `--roster` and
+ * `emit-workflow` must emit byte-identical prompts for the same agent, because
+ * the delivery check compares agents against records — a drift between the
+ * paths would read as a rewritten launch on a run that did everything right.
+ * Exported for that reason: a caller that rebuilt this would be a second
+ * implementation of the invariant, and byte-parity would become something a
+ * test asserts rather than something the code cannot break.
  */
-function buildLaunch(
+export function buildLaunch(
   report: PlanReport,
   planPath: string,
   spec: {