chore: unify agent review workflow

[kapustazh]

Milestone outcome

Give every contributor one review workflow while allowing Codex, Claude,
Antigravity, Cursor, or another capable agent.

Scope

In scope

• Keep AGENTS.md and .agent/ canonical.
• Add thin Antigravity adapter using its current .agents/rules convention.
• Bind Gate A to immutable base and candidate tree SHAs.
• Bind Gate B to exact PR head and the Gate A candidate tree.
• Ignore personal agent configuration.
• Add minimal Agent policy PR check.

Out of scope

• Product implementation.
• Mandatory review vendor or model.
• Windows-only review automation.
• Branch-protection mutation.
• Merging agents-setup or the existing Claude adapter PR.

Acceptance criteria

• Canonical shared policy has one source of truth.
• Tool adapters reference canonical policy.
• Personal configuration is ignored.
• Gate A records reviewer and immutable Git identities.
• Gate B verifies exact PR head tree against Gate A.
• PRs run Agent policy CI.
• Feature work targets develop; humans merge.

Risk review

• Security and secrets: read-only workflow permissions; no secrets added.
• Data safety and privacy: documentation and CI only.
• Architecture and performance: no runtime impact.
• Rollback or safe disablement: revert this commit.

Validation evidence

Command or check	Result
git diff --cached --check 6ea00fd0257fb6531184dab7104bacd7a1100b7a	PASS
Required policy path and adapter-reference checks	PASS
Personal-config ignore checks	PASS
Secret-pattern scan	PASS
Candidate tree equals committed HEAD^{tree}	PASS: f4a1ae0a09193eb1421654af85b94b76b830f726

Review Gate A - implementation

• Reviewed base SHA: 6ea00fd0257fb6531184dab7104bacd7a1100b7a
• Reviewed candidate tree SHA: f4a1ae0a09193eb1421654af85b94b76b830f726
• Reviewer tool: Codex subagent, fresh read-only session
• Reviewer model: not exposed by platform
• Verdict: PASS
• Blocking findings resolved: none in final review
• Evidence: complete 13-path staged candidate reviewed; no blocking findings

Required CI

• Agent policy
• All currently applicable project checks
• No required check is missing, pending, skipped, or failing

Review Gate B - draft PR

• Reviewed PR head SHA: pending
• Reviewed PR head tree SHA: pending
• Matching Gate A candidate tree SHA: f4a1ae0a09193eb1421654af85b94b76b830f726
• Reviewer tool: pending
• Reviewer model: pending
• Verdict: pending
• Blocking findings resolved: pending
• Evidence / review summary: pending

User review

• Review Gate A passed for the current change.
• Required CI checks are green for the current head.
• Review Gate B passed for the current head.
• The PR is marked ready for user review.
• The user explicitly approved merge. Agents must leave this unchecked.