v0.10.0

Specification revision 5: per-repo scope for the defi-com pair, and binding
review verdicts for Automation C.

Two scopes, not one. Pair C/D reviews across defi-com/monorepo,
defi-com/mobile and defi-com/azure-next-hybrid, and repairs only the first
two. azure-next-hybrid is review-only: its own PRs are recorded and never
repaired or pushed to.

Binding verdicts. Automation C submits a real APPROVE or
REQUEST_CHANGES on a peer PR where the account is officially review-requested,
replacing the COMMENT-only automation exception. Pair A/B is unchanged and
keeps COMMENT-only, and a mention-triggered peer review still publishes
COMMENT — a casual "take a look" is not a request for a merge-blocking review.

Blocking obligations. Submitting a review removes the account from GitHub's
review-requested results, so a blocked PR would otherwise leave discovery and
the block would stand forever. C records each unresolved blocking review as a
durable obligation, wakes on it every scheduled tick, polls it directly by URL,
and carries an inherited authority — following the obligation chain across a
teammate's later pushes — to submit the clearing APPROVE without a fresh
request. Supersession is capped at one verdict per head SHA.

Also: ~/defi and ~/dev workspace paths, a green gate that uses the unit-level
command plus CI, inherited-failure holds, and the local review-PR-<num>.html
written alongside every review C publishes.

Suite: 363 pass / 0 fail. Five adviser passes, both advisers AGREE, plus a
four-pass authored review.

This ships the contract. Automations C and D are not created and nothing is
enabled.