reviewer: allow daemon reviews to select prompt directory

[OllieinCanada]

Summary

Allow daemon-launched reviews to select a local prompt profile through an optional review.prompts_path setting.

When the setting is absent, daemon reviews continue to use the existing bundled Linux kernel profile. When it is explicitly set, the directory must exist and contain review-core.md; invalid configuration returns an error before the review subprocess or model starts and never silently falls back.

This is a small plumbing step toward running a dedicated Sashiko instance against Sashiko pull requests. It does not add a Sashiko-specific prompt profile or arbitrary multi-repository support.

Why

The review binary already accepts --prompts, but daemon-launched reviews did not pass it and therefore effectively selected the kernel bundle. This change wires settings through the reviewer to that existing subprocess argument.

Backwards compatibility and safety

• the setting is optional and serde-defaulted, so existing configuration remains valid
• the current kernel prompt profile remains the default
• explicit profiles are local filesystem paths; no remote prompt loading is added
• invalid or malformed explicit profiles fail before subprocess/model execution
• prompt paths are passed as one process argument, not interpreted by a shell
• no AI provider, review protocol, forge/webhook, Git, NNTP, database, worktree, or baseline behavior changes
• no LLM, paid API, or external network service is used by the tests

Deterministic tests

Coverage proves:

• absent configuration resolves to the bundled kernel profile
• an exact configured path reaches the review command and mock subprocess
• paths containing spaces and shell-like characters remain one inert argument
• missing and malformed profiles return clear errors without kernel fallback
• invalid configuration cannot start the review subprocess
• the repository's existing Settings.toml still parses

Validation completed against current upstream main:

• make check-pr RANGE=HEAD~2..HEAD — passed
• cargo test --release --all-features --lib --quiet — 473 passed, 1 ignored, 0 failed
• git diff --check upstream/main...HEAD — passed

The tested current-upstream patch and this branch have the same stable patch ID.