fix(review): recalibrate interactive findings - #463

Problem

Interactive PR review comments could disprove a finding while the original card, severity, scenario, counts, and verdict remained stale. Scenario sidecars could assert an active failure without separate reachability and outcome provenance.

Behavior

• Migrates local review.json workspaces from v1 to v2 deterministically; comments.json remains v1.
• Adds active, question, and withdrawn finding states, immutable original claims, and append-only comment-linked revisions through POST /api/findings/%23<id>/revisions.
• Recalculates the visible verdict from active findings only; status groups, filters, search, audit history, and counts reflect the current lifecycle state.
• Requires scenario assertions to carry distinct trigger/reachability and observable-outcome evidence; unsupported assertions render as evidence gaps.
• Preserves lifecycle state on same-commit re-prepare and refuses operations that would discard revision history.
• Wraps long prose in titles, metadata, scenarios, evidence, comments, and replies while preserving horizontal code scrolling.

Security

The new route reuses JSON content-type validation, same-origin write enforcement, request size limits, bounded atomic persistence, per-review locking, comment-to-finding linkage, loopback-by-default hosting, and no GitHub posting. The non-loopback warning now explicitly includes lifecycle revisions.

Verification

• bun test tests/unit/plugins/pr-interactive-review.test.ts — 13 passing tests.
• bun run typecheck — passed.
• bun run lint — passed (92 source files).
• bun run build — passed.
• Browser E2E: prepared and served an external temporary workspace, submitted a reviewer correction, posted the assistant reply and comment-linked withdrawal, then confirmed desktop and 390px renders show No active findings, Withdrawn findings (1), preserved comment/reply and lifecycle history; narrow viewport had no document horizontal overflow (scrollWidth 375 at innerWidth 390).