fix(pr-review): read explicit exact targets directly

[huangruiteng]

Problem

Explicit reviews of one or two named pull requests were routed through the lifecycle queue scan. The packet therefore applied queue-wide completeness rules and could expand from 100 to 200 or more historical rows before reviewing the requested exact heads.

Outcome

• Add repeatable --target-exact-head NUMBER@HEAD_OID selection.
• Read each requested PR directly with gh pr view; this path does not call gh pr list or scan history.
• Mark successful target packets complete with limit_scope=exact_targets and no recommended limit.
• Fail closed when the remote head differs from the requested SHA.
• Preserve existing queue and lifecycle behavior for unscoped review work.
• Keep --fresh-audit-exact-head separate: selecting a target does not silently force re-audit of a concluded exact head.

The GitHub transport remains owned by loopx/capabilities/pr_review_queue/github_source.py; the existing packet and result contract remains the single review authority.

Entry points

The CLI, capability reference, managed PR-review skill, and focused regression coverage change together. No frontend companion is needed: explicit targets are per-command review input, while the existing capability editor owns persistent priority and wait policy rather than one-off PR identities.

Validation

• 139 focused Python tests passed.
• PR-review command smoke passed.
• Live readback passed for one exact target and two exact targets.
• Wrong-head remote mismatch failed closed in live and unit validation.
• Direct-source regression proves target reads use pr view without pr list.
• Ruff, mypy, TypeScript control-plane typecheck, and diff checks passed.
• Maintainability ratchet and semantic-vocabulary smoke passed.
• Public/private boundary scan passed.
• Premerge canary passed: 19 selected checks, zero failures.
• Change-quality receipt cqr_cdff29767cbf713e3e59 is valid for fingerprint cdff29767cbf713e3e59245924a1db3ec4dde83389035d2b96c2d95d8cd4b8e2.

Review and merge boundary

This changes loopx/** CLI/control-plane behavior, so it is not self-merged. It requires independent exact-head review and maintainer merge authority.

Future-facing pass: the direct-read transport was placed in the existing GitHub source owner instead of adding a second state machine or speculative abstraction.