Isolate manually dispatched review-gate PR execution from default-branch caches

[lamemustafa]

Problem

CodeQL alert #4 flags cache poisoning where the review-gate job checks out a selected PR head and then installs dependencies with setup-node's pnpm cache.

The alert reports both scheduled and manual-dispatch paths:

• The scheduled path is not reachable: review-gate has if: github.event_name != 'schedule', while the separate scheduled-review-gate writer checks out and executes only default-branch code.
• workflow_dispatch can execute the selected PR head and restore/save the pnpm cache. Triggering a manual workflow dispatch requires repository write access, and the job itself has only contents: read and pull-requests: read, but the selected PR content may still be authored by an external contributor.

This behavior predates the scheduled mechanism in #147. Round 3 has already used its single authorized push, and its objective explicitly forbids adding more machinery for a post-push scheduled-mechanism finding.

Scope

Determine the smallest isolation for the manual-dispatch path without changing the trusted scheduled reconciler or weakening review blockers.

Acceptance criteria

• Confirm the exact GitHub permission required to dispatch this workflow and document the external-contributor influence boundary.
• Ensure manually dispatched execution of a PR head cannot write or poison a cache later restored by privileged/default-branch workflows.
• Prefer removing cache use from the manual-dispatch path if that is sufficient; do not add broad permissions, dependencies, or a privileged PR-code path.
• Keep the existing pull request/review triggers and the trusted scheduled reconciliation behavior intact.
• Preserve Review gate exit semantics, exact-head binding, fork handling, and default CLI arguments.
• Add focused workflow assertions and run actionlint, full Vitest, typecheck, lint, formatting, workflow preflight, and CodeQL.
• Link the resulting evidence back to alert docs: tighten public issue data warnings #4 and PR fix(ci): fail closed on incomplete review evaluation #147.

[lamemustafa]

Fixed by #147 (2942bb7). The workflow split moved workflow_dispatch into review-gate-reconcile.yml, which checks out the default branch only and runs no install or preflight, so no dispatched run executes PR-authored content. CodeQL alert #4 reports fixed and the CodeQL check passes on the merged head.