feat(review): remove --post, drop JSON contract, let Claude handle posting

[JohnnyVicious]

Why

Third attempt at `--post` exposed that parser-side heuristics are the wrong abstraction:

• v1.0.9: hit the undici body-timeout bug
• v1.0.10: added a stderr handoff trailer to shift posting to Claude Code (dropped `gh api --paginate`)
• v1.0.11: taught the parser to tolerate unescaped inner quotes in review JSON
• Then a real adversarial-review run on PR #412 produced valid JSON of a different shape (`{findings: [{summary, findings: [...]}]}` with no top-level `verdict`), the schema-aware parser rejected it, the companion fell through to printing raw JSON, and the posted PR review was raw JSON embedded in a code block again.

Chasing model-invented schemas is a losing game. The pivot we converged on in the plan thread: rip the whole flag out, drop the JSON output contract entirely, and let Claude Code handle posting via its own Bash tool when the user asks.

What changes

Removed

• `--post` and `--confidence-threshold` flags from both review handlers
• `plugins/opencode/scripts/lib/pr-comments.mjs` (payload builder, trailer emitter, gh plumbing)
• `plugins/opencode/scripts/lib/review-parser.mjs` (schema-aware JSON parser)
• `renderReview` from `render.mjs` — no callers left
• 48 tests across 3 files covering the above
• `parseConfidenceThreshold` and `emitPostTrailer` helpers in the companion
• The `<structured_output_contract>` section of the adversarial prompt
• The "respond in JSON matching the review-output schema" line in the standard review prompt
• The "Post-review publishing" section in both slash-command docs

Added

• A simple per-finding prose shape in both review prompts: `### — <title>`, `File:`, `Confidence:`, analysis paragraphs, `Recommendation:`. Severities are `LOW | MEDIUM | HIGH | CRITICAL`.
• An "Optional: post the review to GitHub" section in both slash-command docs that fires only when the user explicitly asked in natural language ("and post it", "comment it back", "publish the review"). A bare `--pr 412` is NOT a request to post.
• The post flow: Claude composes its own markdown summary in its voice, writes a `gh api … /reviews` payload to a temp file via the `Write` tool, POSTs via a single Bash call, extracts `html_url`, and appends a one-line status. Never `REQUEST_CHANGES` — always `COMMENT`.

Net effect

• Companion is simpler — raw review text goes in, raw review text comes out (with the existing model header).
• Chat output is readable prose the model produced directly. No more "ugly JSON dumped in chat" failure mode because there is no JSON contract to fail.
• Posting is Claude's job, where it belongs — Claude has full editorial discretion over the summary body and full access to `gh`.

Test plan

• `npm test` → 220/220 pass (down from 268 because 48 cases covered the removed post-plumbing)
• Manual: re-run `/opencode:adversarial-review --pr 412 --background` and confirm the chat output renders as readable markdown prose (no more raw JSON dumps)
• Manual: add "and post it back" to the request on a small test PR and confirm Claude composes a clean summary and publishes via `gh api`

Out of scope (explicitly)

• Bringing deterministic inline comments back. If the user wants that later, we'd add a well-scoped helper Claude could call — not re-introduce parser heuristics.