feat(review): add portable subject composition contracts

[limityan]

Summary

Adds a small portable contract for composing review subjects without introducing a separate model-planning phase.

• Represents Issue, pull request, Git range, workspace, explicit-file, and external-reference candidates with stable candidate identity.
• Produces only subject relationships (mode and role); review questions, output shape, tool choice, and execution strategy remain owned by the main review model.
• Uses deterministic composition only for explicit, low-ambiguity intent: single subject, explicit comparison, and explicit requirement-trace language.
• Leaves ambiguous mixed-subject requests as multi-subject input so the main model can decide the relationship in context.
• Preserves every candidate exactly once and applies small public-boundary limits before allocation or text scanning.

Deliberate exclusions

• No additional model call, prompt, repair call, retry, or Agent-loop behavior.
• No desktop command or Web API.
• No launch, evidence collection, persistence, review execution, or UI-status changes.
• No model-owned question or output constraints.
• No DeepReview changes.

Validation

• cargo test -p bitfun-product-domains --features product-full --test review_policy -- --nocapture (12 passed)
• cargo test -p bitfun-product-domains --no-default-features -- --nocapture (passed)
• cargo check -p bitfun-product-domains --features product-full (passed)
• cargo check --workspace (passed; existing repository warnings only)
• git diff --check upstream/main...HEAD (passed)

node scripts/check-core-boundaries.mjs still reports the existing review-platform optional dependency ownership baseline for sha2 and windows; this PR does not touch that integration feature or Cargo manifest.

Review focus

Please verify that deterministic inference remains limited to explicit user intent, ambiguous scenarios remain model-owned, and the public contract bounds do not narrow supported review target types.