feat(review): add local coderfeli review watcher

[jhinpan]

Stacked on #1157, which is stacked on #1106. This layer adds only the local operator: immutable coderfeli/repository gates, SQLite claim state keyed by PR head and engine SHA, exact base/head source preparation, a pinned no-GPU review image, timeout/crash recovery, local-only artifacts, publication-disabled canary support, and disabled systemd user templates. The container receives the node model gateway variables by name but no GitHub credential; host-side publication remains identity/OID checked and defaults to dry-run.

The pilot enables --group-finders and submits one model session at a time. The measured gateway serialized concurrent Opus/max calls: concurrency nine inflated median request latency by about 11.7x and made aggregate completion slower than serial submission. Model sessions expose only Read, Grep, and Glob under the root-deny filesystem policy; no reviewed-tree Bash or code execution is available.

A frozen PR #1137 end-to-end canary completed the grouped finder, six independent verifications, two challenges, sweep, artifact reconstruction, and dry-run publisher in 2,154 seconds for $12.89 with zero permission denials. The final artifact contained one confirmed P2 and five plausible risks, so the P1 publication threshold produced no GitHub review.

Independent adjudication of the finder-only sample retained two plausible P2 risks, refuted three candidates, and identified one missed strong P2: ten graph operations overwrite one output while only the final write is observed. The owning test-contract checklist now explicitly audits distinct observed results and overwritten intermediate outputs. This evidence supports pilot use over the non-completing nine-session configuration; it does not establish general recall or equivalence to nine independent finders.