factory: reviewer verdict — structured output + review against the issue, not just the diff

[ALLiDoizCode]

Gives the factory reviewer a verdict channel and the missing Spec axis (toon-meta#275, epic toon-meta#270) — port of toon-protocol/toon-meta#299 to swap.

What changes

• Structured verdict, enforced. Every reviewer run must end with <review>{"verdict":"clean"|"blocking","blockingFindings":[{file,line,summary,why}]}</review>. The schema is declared as sandcastle.Output.object({ tag: "review", schema }); extraction/validation is performed by the new .sandcastle/review-verdict.ts because — verified against the @ai-hero/sandcastle@0.12.0 dist — the engine's structured-output surface exists only on top-level run(), and the sandbox.run() the runners use silently ignores an output option. Extraction mirrors the engine's semantics exactly (last tag wins, fence-aware unwrap, JSON parse, zod schema validation).
• Malformed verdicts fail the run. One retry via SandboxRunResult.resume() (the engine's own structured-output retry mechanism, exactly one iteration, with engine-style error feedback); if the verdict is still malformed the runner throws and the Actions job goes red — a missing verdict is never mistaken for a clean one.
• Spec axis. The implement runner forwards ISSUE_NUMBER/ISSUE_TITLE via promptArgs; the standalone agent:review runner resolves the issue from the PR body's Closes #n (no reference → Standards-only review). The prompt instructs the reviewer to gh issue view the target FIRST and review the diff against its acceptance criteria. main.ts (the reserved autonomous loop) passes the new promptArgs too so the prompt's placeholders always resolve.
• Blocking side effects. Findings are posted as a PR review (event COMMENT) and needs:human is applied — pure REST via gh api (porcelain gh pr edit is broken in repos with a classic Project attached by the projectCards GraphQL deprecation). In auto-merge mode a blocking verdict refuses to merge and falls back to PR mode.
• Standalone runner unbroken. Adopts connector#634's proven first-live-run fix: the workflow checks out main (git refuses one branch in two worktrees), and the runner materialises the PR head as a local branch so the engine's worktree add -b … HEAD fallback cannot silently review an empty diff.

Forensics steps (toon-meta#278) and the ~200k context-budget prompt wording (toon-meta#273) are preserved. zod was already a devDependency here (^3.25.0, v3 API) — no lockfile change.

Verification

• Extraction smoke-tested in-repo (valid clean/blocking, fenced JSON, last-tag-wins, missing tag, invalid JSON, bad enum, blocking-without-findings, clean-with-findings, null line) — all 10 pass; temp script deleted before commit.
• Both runners import-smoke-tested: each fails on its env guard (SANDCASTLE_PR_NUMBER / SANDCASTLE_ISSUE_NUMBER) and nothing else.
• swap's own gate green: pnpm run gate:correctness (build + eslint 0/352 vs frozen 0/352 + typecheck 0 vs frozen 25), pnpm test (285 passed, 2 skipped), pnpm run gate:no-regression (26.3s vs 30.9s baseline).
• Live proof (clean + blocking on real PRs) comes with the first agent:review run after merge, since this label→runner executes main's code.

Part of toon-protocol/toon-meta#270
Part of toon-protocol/toon-meta#275

🤖 Generated with Claude Code