[TICK 3-001] Fix Trust Gate JSON parsing for markdown-fenced LLM responses

[timeleft--]

Summary

• Adds _extract_json_from_llm_response() to trust_gate.py that strips markdown code fences (```json / ``` ``), leading/trailing whitespace, and extracts the first JSON object from preamble-wrapped responses before callingjson.loads()`
• Wires the sanitizer into _parse_verdict() (replacing bare json.loads(content) at line 223)
• Adds 8 new test cases covering all sanitization paths, including an end-to-end test through review_thought()

Root Cause

trust_gate.py:223 called json.loads(content) directly on the raw LLM response. Gemini 2.5 Flash occasionally wraps its structured JSON output in markdown fences even when response_format: json_object is set, causing a JSONDecodeError at char 1. After the retry, the thought ended up with validation_status: "error" instead of the reviewer's actual verdict.

Test plan

• test_extract_json_fenced_with_lang_tag — ```json ... ```
• test_extract_json_fenced_no_lang_tag — ``` ... ```
• test_extract_json_leading_trailing_whitespace
• test_extract_json_with_preamble_text — "Here is my response: {...}"
• test_extract_json_clean_no_fences — clean JSON passes unchanged
• test_extract_json_genuinely_invalid — no JSON → json.loads() error preserved (fail-closed intact)
• test_extract_json_nested_braces — nested {} handled (first { to last })
• test_review_thought_fenced_json_response — end-to-end: fenced response → correct verdict
• All 176 existing tests pass (no regressions)

Fixes: Issue #5

🤖 Generated with Claude Code