v0.12.0 — Diff-chunking stability

Diff-chunking stability core

Rebuilds the diff-chunking subsystem so reviews stay stable on large PRs — no more dropped batches, token-budget overruns, or all-or-nothing skips. Grounded in how Qodo/PR-Agent, CodeRabbit, Cursor Bugbot, and Ellipsis handle the limited-context constraint.

What changed

• Output truncation no longer drops findings. Output max_tokens is configurable per provider; on truncation the batch splits-and-retries instead of dropping its review. The PR is never aborted on truncation.
• One honest, derived token budget. A single real tokenizer (js-tiktoken) feeds both the batcher and the per-call guard over the exact serialized prompt. The per-call budget is derived from the provider's context window (hard_cap_in = window − reserved_output − prompt_overhead − safety), replacing the hand-tuned 60k/120k literals.
• Genuinely small chunks. A file larger than the budget is split at hunk boundaries (line numbers and dedupe preserved) instead of being skipped wholesale.
• Graceful degradation. A sizing trip splits/skips the batch instead of aborting the whole PR (genuine auth errors still abort). An oversized PR now gets a prioritized partial review with a visible "not reviewed" list.

New config (all optional, safe defaults)

chunking.reserved_output_tokens (4096), chunking.max_truncation_retries (2), chunking.prompt_overhead_tokens (9000), chunking.safety_fraction (0.07); env ANTHROPIC_/COPILOT_/OPENAI_MAX_OUTPUT_TOKENS. call_token_budget and MAX_TOKENS_PER_PR are kept as optional ceilings. See docs/config-spec.md and ADR-006.

Backward compatibility

Fully backward-compatible: existing configs/envs still apply as ceilings, and happy-path review output is unchanged.

Full diff: #31