refactor(review): make strict delegation on demand

[limityan]

Summary

This change simplifies strict review into a bounded, model-led workflow. The primary strict reviewer now reviews the prepared target directly and decides whether one focused specialist perspective is materially useful. An independent quality check is reserved for high-severity findings, conflicting evidence, or materially low confidence.

The runtime enforces the specialist ceiling even when a weaker model does not follow the prompt. New strict launches no longer pre-generate reviewer work packets, split files across same-role agents, or retry reviewers automatically. Historical manifests retain packet, batch, shard, retry, and recovery compatibility.

The launch confirmation and architecture guidance now distinguish review-agent executions from underlying model requests. They disclose one planned primary execution and at most three review-agent executions, while explicitly avoiding unsupported token or provider-request estimates.

Motivation

The previous design treated strict review as a largely pre-orchestrated multi-agent workflow. That increased prompt size, latency, token use, failure surfaces, and product complexity even when the primary model could complete the review itself. This revision keeps deterministic safety boundaries in the runtime while returning investigative depth and specialist selection to the reviewing model.

Behavior and compatibility

• Ordinary review remains a single read-only reviewer.
• Strict review remains explicit and read-only.
• A new strict run uses one primary reviewer, at most one optional specialist, and at most one conditional quality inspector.
• The backend rejects attempts to exceed the new specialist limit.
• Historical review manifests continue to execute their existing packets and declared retry policy without being rewritten as new strict runs.
• Evidence limitations remain explicit and cannot be converted into a clean result.
• The generic agent loop is unchanged.
• Existing design documents were consolidated and trimmed; no new design document was added.

Validation

• pnpm run type-check:web
• pnpm run i18n:audit
• Focused Web review and consent tests: 96 passed in the combined run; final changed slices: 57 passed
• cargo test -p bitfun-agent-runtime deep_review -- --nocapture: 97 passed plus related contract tests
• cargo test -p bitfun-core deep_review -- --nocapture: 58 passed
• cargo check --workspace --exclude bitfun-desktop
• git diff --check

A full workspace check reached the desktop build script and stopped because the local src/mobile-web/dist prerequisite was absent. The non-desktop workspace check passed. An independent final review found no remaining Critical or Important issues.