factory: reviewer verdict — structured output + review against the issue, not just the diff

[ALLiDoizCode]

Gives the factory reviewer a verdict channel and the missing Spec axis (#275, epic #270).

What changes

• Structured verdict, enforced. Every reviewer run must end with <review>{"verdict":"clean"|"blocking","blockingFindings":[{file,line,summary,why}]}</review>. The schema is declared as sandcastle.Output.object({ tag: "review", schema }); extraction/validation is performed by the new .sandcastle/review-verdict.ts because — verified against the @ai-hero/sandcastle@0.12.0 dist — the engine's structured-output surface exists only on top-level run(), and the sandbox.run() the runners use silently ignores an output option. Extraction mirrors the engine's semantics exactly (last tag wins, fence-aware unwrap, JSON parse, zod schema validation).
• Malformed verdicts fail the run. One retry via SandboxRunResult.resume() (the engine's own structured-output retry mechanism, exactly one iteration, with engine-style error feedback); if the verdict is still malformed the runner throws and the Actions job goes red — a missing verdict is never mistaken for a clean one.
• Spec axis. The implement runner forwards ISSUE_NUMBER/ISSUE_TITLE via promptArgs; the standalone agent:review runner resolves the issue from the PR body's Closes #n (no reference → Standards-only review). The prompt instructs the reviewer to gh issue view the target FIRST and review the diff against its acceptance criteria.
• Blocking side effects. Findings are posted as a PR review (event COMMENT) and needs:human is applied — pure REST via gh api (porcelain gh pr edit is broken here by the projectCards GraphQL deprecation). In auto-merge mode a blocking verdict refuses to merge and falls back to PR mode.
• Standalone runner unbroken. Adopts connector#634's proven first-live-run fix: the workflow checks out main (git refuses one branch in two worktrees), and the runner materialises the PR head as a local branch so the engine's worktree add -b … HEAD fallback cannot silently review an empty diff.

Forensics steps (#278) and the ~200k context-budget prompt wording (#273) are preserved.

Verification

• Extraction smoke-tested (valid clean/blocking, fenced JSON, last-tag-wins, missing tag, invalid JSON, bad enum, blocking-without-findings, clean-with-findings, null line) — all pass.
• Both runners import-smoke-tested to their env guards; npm run gate green; actionlint green on the workflow.
• Live proof (clean + blocking on real PRs) runs on the first fanned-out repo whose PR merges, since this label→runner executes main's code.

Part of #270
Closes #275

🤖 Generated with Claude Code

[ALLiDoizCode]

Live proof — both directions (relay, first repo to merge the port)

The relay port (toon-protocol/relay#104) merged first and hosted the acceptance-criteria proof via the standalone agent:review label runner, on real PRs against real issues:

Clean: relay PR #107 (correctly implements relay#105, Closes #105 in the body) — run 31098191838, job success. Log: Reviewer verdict: CLEAN → reviewer pushed 1 refinement commit to the PR branch → Verdict clean — no blocking findings. No review posted, no needs:human.

Blocking: relay PR #108 (deliberately defective against relay#106: contradicted two acceptance criteria and deleted a section the issue said must not be removed) — run 31098192016, job success. Log: Reviewer verdict: BLOCKING (3 blocking finding(s)) → PR review posted with all three findings each mapped to the violated criterion, and needs:human applied. The Spec axis demonstrably drove the verdict: the reviewer ran gh issue view 106 and cited the issue's criteria verbatim in the why fields.

The proof also exercised the standalone plumbing this PR fixes: ref: main checkout + local materialisation of the PR head produced a correct non-empty diff, Closes #n resolution, in-sandbox gh issue view, and push-back of reviewer commits.

Proof scaffolding cleaned up: relay PRs #107/#108 closed (branches deleted), issues relay#105/#106 closed.