fix: distinguish a mis-anchored finding from a fabricated one

[Codevena]

Closes the true-positive hole pilot-02 exposed. Design of record:
docs/superpowers/specs/2026-08-05-true-positive-hole-design.md.

The defect

pilot-02 turn 2 seeded a path traversal. The panel detected it twice; both detections ended at
INFO and the turn scored a miss. The one that mattered was killed before the critic ever ran:

F-002  path-traversal  line 67  conf 0.90  ->  fact_invalid: true
  [reviewgate fact-check] cited location src/store.ts:67 does not exist in the working tree
  (file has 27 lines) - almost certainly hallucinated; demoted to advisory.

src/store.ts is a brand-new 27-line file. But the finding carried the reviewer's own quote:

evidence_line: "  return readFileSync(`./templates/${name}`, 'utf8')"

which is verbatim line 26. The reviewer read real code and mis-numbered the line. It was
mis-anchored, not fabricated - and the gate told the agent the opposite about a real path
traversal. That one bad anchor caused all three failures: the fact_invalid demote, the missed
merge (25 vs 67 is past both merge windows), and hence singleton consensus, which left the critic
free to demote the second detection too.

What changes

Slice A - distinguish mis-anchored from fabricated. validateFindingFacts now consults the
reviewer's own evidence_line before demoting. A quote that matches a real line of the cited file
and carries an identifier-like token re-anchors the finding to that line instead of demoting it.
No quote, or a quote matching nothing, demotes exactly as before - the empty-file case the pass was
built for is untouched. Runs pre-aggregation, so the repaired line feeds clustering: turn 2's two
findings end up one line apart, merge, reach majority, and corroboration bars the critic. Costs
zero extra I/O (reuses the file the pass already read) and needs no orchestrator change.

Slice B - critic severity floor. The critic's security/correctness exemption was keyed to
CRITICAL, while the sibling delta-scope pass exempts the same categories at any severity. It now
covers WARN too - the one demote that crosses the blocking boundary. Already-INFO stays droppable,
so the critic keeps filtering where reviewers are noisiest.

Both always-on, no new config key. anchor_repaired is marker-observable so pilot-03 can count it.

Review

Five tasks, each implemented by a fresh agent and reviewed independently; then a whole-branch review.

The whole-branch review found a real security hole the per-task gates missed: a punctuation-only
quote (}) was a valid repair key, turning a fabricated 0.97 CRITICAL from PASS into a hard FAIL.
Fixed by requiring an identifier token. It also rejected a premise in the spec ("quoting real source
proves the finding is mis-anchored" - } is real source); the risk table now says so honestly.

The guard width was then contested: this repo's own gate asked to lower the bound so a genuine line
whose longest token is 2 chars (if (a || b) {) is not wrongly demoted, while the reviewer argued
against. Measured over all 35 distinct evidence_line values recorded across both pilots, both
bounds reject 0 - and the reviewer's stated objection was factually wrong. Ruled for the gate, then
re-ran the full adversarial battery against the shipped code: 0 attack leaks, 0 true positives
lost, empty-file protection intact.

Verification

• bunx tsc --noEmit clean, bun run lint clean, full bun test 3184 pass / 12 skip / 0 fail.
• Every new guard test seen red first via mutation in a throwaway copy.
• The acceptance test reconstructs the real recorded incident; its 27-line fixture is byte-identical
  to the added lines of rig/results/pilot-02/turns/2/diff.patch.
• Revert matrix: reverting Slice A's re-anchor, or the marker propagation, or the badge each turns the
  acceptance test red. Reverting Slice B does not - because corroboration alone bars the critic in
  that scenario. The test comment says so rather than claiming more than it proves; Slice B's own case
  is covered by a dedicated singleton test.

Not included

• No bun run build - the rebuild re-pins the binary and belongs to the pilot-03 sequencing.
• M5 critic-cost attribution stays out (provider-contract change).
• Signature reordering stays out (would invalidate every persisted signature and cache entry);
  recorded as deliberate in the spec's out-of-scope section.