fix(orb): diffFilePriority's vendored-directory regex is stale in both src/review twin copies

[JSONbored]

⚠️ Definition of Done: this issue must be completed in full, in a single PR. Do not split this
work across multiple PRs, and do not defer any Deliverable below to a follow-up issue. A PR that
satisfies only some of the Deliverables, stubs a required test, or leaves a checkbox
partially-done does NOT resolve this issue and will be closed.

Context

Commit 1a019aba8 ("fix(engine): diffFilePriority's vendored-directory pattern misses
vendored/third_party/third-party/bower_components/jspm_packages (#7540)", closing #7526) fixed the
vendored-directory regex in the canonical implementation,
packages/loopover-engine/src/review/diff-file-priority.ts:11.

That fix was never applied to the two byte-identical twin copies of the same function in
src/review/review-diff.ts:30 and src/review/review-grounding.ts:196. Both twins still carry the
pre-fix pattern (dist|build|out|coverage|vendor|node_modules), missing vendored, third_party,
third-party, bower_components, and jspm_packages.

This gap is invisible to the CI drift check meant to catch exactly this: scripts/check-engine-parity.ts's
DIFF_FILE_PRIORITY_TWIN_PAIR table only asserts that src/review/review-diff.ts contains the
function signature and the isLockfile(path) substring — it never diffs the regex body against the
canonical source, and review-grounding.ts's copy isn't in the twin-pair table at all.

Consequence: a file under third_party/, vendored/, bower_components/, or jspm_packages/ is
scored priority-0 ("source") instead of the correct priority-4 by both src/review twins, which can
(a) displace real contributor source under a tight AI-review diff budget, and (b) is reused by
src/queue/copycat-detection.ts's isComparableSourcePath, risking false plagiarism-style matches
on shared vendored boilerplate. test/unit/review-diff.test.ts / review-grounding.test.ts have no
test case for any of these five directory names.

Requirements

• Update the vendored-directory regex in both src/review/review-diff.ts:30 and
  src/review/review-grounding.ts:196 to match the already-fixed canonical pattern in
  packages/loopover-engine/src/review/diff-file-priority.ts:11 exactly.
• Extend scripts/check-engine-parity.ts's DIFF_FILE_PRIORITY_TWIN_PAIR (or equivalent drift
  check) so it diffs the actual regex body of all three copies against the canonical source, not
  just a substring/signature presence check, and add review-grounding.ts to the checked twin set
  if it is missing from the table today.

Deliverables

• src/review/review-diff.ts's diffFilePriority vendored-directory regex matches the
  canonical, already-fixed pattern.
• src/review/review-grounding.ts's copy has the same fix.
• scripts/check-engine-parity.ts diffs the actual regex body (not just signature presence)
  across the canonical file and both twins, and fails CI if they diverge again.
• New tests in both test/unit/review-diff.test.ts and review-grounding.test.ts (or the
  shared engine-parity test) proving diffFilePriority("vendored/lib.js"),
  diffFilePriority("third_party/x.js"), and diffFilePriority("bower_components/x.js") all
  return 4 in both twin copies — currently 0.

All four Deliverables are required in the same PR.

Test Coverage Requirements

src/** is measured by codecov/patch (99%+ target, branch-counted). New tests must exercise the
five previously-missing directory names directly in both twin files, plus a regression test for the
strengthened check-engine-parity.ts drift check itself (proving it would catch a reintroduced
divergence).

Expected Outcome

All three copies of diffFilePriority (the canonical engine version and both src/review twins)
agree on vendored-directory classification, and the CI drift check would catch any future divergence
in the regex body itself, not just the function's presence.

Links & Resources

• packages/loopover-engine/src/review/diff-file-priority.ts:11 (canonical, already-correct)
• src/review/review-diff.ts:30, src/review/review-grounding.ts:196 (stale twins)
• scripts/check-engine-parity.ts (DIFF_FILE_PRIORITY_TWIN_PAIR, the drift check to strengthen)
• Fixed canonically by commit 1a019aba8 (fix(engine): diffFilePriority's vendored-directory pattern misses vendored/third_party/third-party/bower_components/jspm_packages #7540, closing fix(engine): diffFilePriority's vendored-directory pattern misses vendored/third_party/third-party/bower_components/jspm_packages #7526)
• See [[gittensory-engine-parity-twin-files-2026-07-14]] for the byte-identical twin convention this
  repo relies on

[linear-code]

JSO-5998