v1.5.0 — Deliberation Hardening

Deliberation Hardening phase: the two-provider (Codex + Gemini) deliberation system is now correct, honest, and visible, plus a critical structured-output fix that unbreaks live Codex reviews.

Critical fix

• Live Codex structured reviews now work. An optional review_mode field had leaked into the model-facing response schema; OpenAI structured outputs reject any schema whose required omits a property, so every live Codex plan/code/precommit review was failing (silently degrading to Gemini). Fixed and locked with a recursive schema-validation test. This regression only ever existed on unreleased main — but if you were seeing Codex silently fall back to Gemini, upgrade.

New features

• Per-call deliberation toggle — --deliberate / --no-deliberate (CLI) and a deliberate input (MCP) to force or skip two-provider review for a single call, regardless of configured mode.
• review_mode in every result — single / failover / deliberate / deliberate-deep, so you can always tell which composition served a review.
• Semantic cross-provider agreement matching — findings the two providers both flag now actually merge into agreed[] (previously exact file:line:category matching left it near-empty). Uses a line-window + category-aware match derived from real two-provider data; no duplicates across agreed/divergent.
• Session ownership routing + cross-provider guard — a session created by one provider is routed back to it on resume, and resuming under a backend that doesn't serve that provider is rejected with a clear message instead of failing cryptically.

Fixes & polish

• Diff validation accepts binary-only and rename-only git diffs.
• Deliberate-deep cross-review slices the subject to the referenced files (bounded cost) and fails cleanly when still over budget.
• MODEL_ERROR now gives a distinct, accurate tip when the rejected model differs from the one actually sent (a Codex-internal subsystem call), instead of unhelpful "change your model" advice.
• Config audit: removed a dead max_file_size field, wired precommit.auto_diff (with --auto-diff / --no-auto-diff), and the loader now warns on unrecognized config keys instead of silently ignoring them.

Full test suite: 786 passing. Verified end-to-end against live Codex + Gemini.