[feat] Risk-flagging review pane — AI layer (claude -p primary)

[Sph3ricalPeter]

Priority: P2 — optional polish on the rules layer; the last thing built in the v2.0.0 pivot
Effort: ~3–5 days
AI substrate: Claude Code (claude -p) primary; Local / BYOK fallback — see #57
Depends on: #52 (rules layer), #57 (AI config), #46 (issue context — for the keystone check)

Right column of the risk-flagging pane. Optional, off by default. Calls the configured AI substrate (#57) — primarily the user's claude -p — for the fuzzy reasoning the rules layer can't do. Suggestion-only, never blocking, always cancelable.

Checks (run only when the AI layer is enabled)

1. Summary — "what does this change do, in 2 sentences."
2. Diff ⊨ acceptance criteria (keystone) — "does this diff satisfy the linked Linear issue's acceptance criteria?" Runs only when issue context ([feat] Issue context panel in commit/diff UI #46) is present. This is the most valuable check in the AI layer and the reason the substrate is claude -p rather than a 7B local model — it needs real reasoning over both the diff and the criteria. Output: per-criterion satisfied / partial / not-addressed + a one-line note.
3. Scope-creep — "what in this diff looks unrelated to the stated intent?" High value for sprawling agent-authored diffs.

Scope

• Substrate selected via [feat] Tiered AI configuration — Claude Code (claude -p) as primary substrate #57 (Claude Code / Local / BYOK / Off); per-feature override allowed.
• Claude Code path: one bounded claude -p --output-format json call per check (or one batched call returning all three) — no agent loop.
• Streaming / quick-return output to keep the pane responsive; Cancel button; checks never block Commit.
• Graceful degradation when the substrate is unavailable (binary missing, offline).

Acceptance criteria

• AI layer is off by default; enabling it routes through [feat] Tiered AI configuration — Claude Code (claude -p) as primary substrate #57's substrate
• Claude Code tier runs the three checks via claude -p and returns typed results
• Keystone criteria-match runs only when issue context ([feat] Issue context panel in commit/diff UI #46) is present
• All checks degrade gracefully if the substrate is unavailable
• Output is suggestion-only, never blocking; Cancel works
• Calls are bounded (≤ a few per review) — no unbounded / agent usage