gate: move every objectively-checkable criterion from LLM judgment to deterministic checks

[JSONbored]

Context

Parent: #8828 (Phase 3 — mechanism; the single largest available accuracy gain and it is not an ML technique). Most gate criteria are objectively checkable — CI state, mergeable-clean, linked-issue eligibility, path allowlist, patch coverage, generated-artifact drift. Every criterion moved from LLM judgment to a deterministic check is 100% accurate by construction and shrinks the surface the confidence/abstention machinery must cover.

Requirements

• Inventory every input currently influencing the AI review verdict; classify each as objectively-checkable vs genuinely-subjective. Deliver the inventory as a table in the PR description.
• For each objectively-checkable criterion still flowing through the LLM prompt: implement it as a deterministic rule (or confirm an existing rule already owns it and remove the duplicated prompt influence), so the LLM never overrides a fact.
• The AI judge's rubric shrinks to the subjective residual, graded per-dimension with isolated judge calls (one dimension per call), each with an explicit "unknown" abstain option that maps to hold — never a guessed verdict.
• Deterministic combination: structured per-dimension findings → verdict via a pure, tested function. No free-text parsing on the decision path.

Test Coverage Requirements

99%+ patch coverage, branch-counted; each extracted deterministic check gets both-arm tests plus a regression test proving the LLM path can no longer flip it.

Expected Outcome

The gate's accuracy ceiling rises structurally: facts are decided by code, judgment is scoped to what genuinely requires it, and abstention is a first-class output.

[linear-code]

JSO-6117

[JSONbored]

Input inventory (the analysis half of this issue)

Full audit of everything flowing into the dual-model review prompt (buildSystemPrompt/buildUserPrompt, src/services/ai-review.ts), classified objectively-checkable vs genuinely-subjective. Highlights:

Objectively-checkable inputs the model currently re-judges (double-judging surfaces):

Fact	Deterministic owner	Status
CI pass/fail/pending	buildCheckAggregate + planner ciState	enforced by PR #8845 (was instruction-only)
Missing test evidence	signals/test-evidence.ts, missing_test_evidence	still fed as free text, model re-decides blocker-vs-nit
Leaked secret / vulnerable dep	secrets-scan.ts, REES, lockfile_tamper_risk	model decides whether a scanner-confirmed hit becomes a blocker; security_focus even asks it to escalate
PR size vs repo norm	sizeGateMode / oversized_pr	culture-profile prose, unverified
Base staleness	fetchBaseAheadBy, stale_base_ref	preference-only
Symbol existence	full file content + impact map are in-prompt ground truth	three prose paragraphs plead against hallucinated absence; no post-parse check

Abstention audit: the main review JSON has no per-finding "unknown"; whole-review bail is reserved for mechanically-broken diffs (and #8789 narrowed it); absent confidence was read as 1.0 (fixed in #8845). valueAssessment.magnitude:"unclear" and linked-issue-satisfaction's confidence-0 default are the good precedents to mirror.

Remaining extraction items, in recommended order (each its own PR):

1. Structured, verifiable blocker schema — {claim_kind, path, line, evidence_ref} per blocker so missing-symbol/missing-test/missing-guard claims are machine-checked against the file content already in the prompt. This is what makes the anti-hallucination rules enforceable at all. Requires REVIEW_PROMPT_VERSION bump.
2. Move test-evidence, size-vs-norm, and base-staleness out of the prompt into their own advisory findings; delete the prompt sections (all three are already computed).
3. Non-negotiable enrichment facts — scanner-confirmed CVE/secret/lockfile hits become findings by rule, not by model discretion.
4. Explicit "unknown" in the finding schema, honored as a hold route.
5. Secondary: the screenshot-vision summary launders an advisory-only vision verdict into the blockable reviewer channel.