fix: reject task-specific Hermes review candidates

[cafitac]

Summary

• reject task-specific Hermes review constraints from becoming durable learning candidates
• add regression coverage for Do not modify files and Do not assume prior reviews are correct
• cover the adjacent Do not inspect or report unrelated files wording in the new rejection heuristic

Evidence

• isolated replay of session_end-20260428_213448_79a706.json currently produced candidate-modify-files.md
• isolated replay of session_end-20260428_173757_a990f7.json currently promoted candidate-assume-prior-reviews-are-correct.md
• both came from review-task instructions, not reusable cross-session learning

Test Plan

• PYTHONPATH=src .venv/bin/python -m pytest tests/test_pipeline.py::test_process_events_rejects_task_specific_review_constraint_do_not_modify_files tests/test_pipeline.py::test_process_events_rejects_task_specific_review_constraint_prior_reviews -q
• PYTHONPATH=src .venv/bin/python -m pytest tests/test_pipeline.py::test_process_events_rejects_real_runtime_malformed_code_fragment_candidate tests/test_pipeline.py::test_process_events_rejects_task_specific_review_constraint_do_not_modify_files tests/test_pipeline.py::test_process_events_rejects_task_specific_review_constraint_prior_reviews tests/test_pipeline.py::test_extract_candidate_ignores_hermes_skill_wrapper_in_user_message -q
• npm test
• PYTHONPATH=src .venv/bin/python -m pytest -q