pxx 2.5.4

Added

• pxx doctor flags self-review — the reviewer defaults to the author model.
  Settings.effective_review_model falls back to the coder model when no [roles.review]
  overlay is set, so the shipped default puts the same model that wrote the diff in front
  of it as the judge — while pxx loop --review runs BLOCKING by default. A model cannot
  independently review its own output: it carries the blind spot that produced the defect,
  so the gate reports a pass it was never able to withhold, and that pass is then recorded
  as evidence. This is the vacuous-gate failure mode, and it is worse than having no gate.
  The new review:independence check reports three states: a distinct reviewer model passes;
  the same model on the same endpoint warns as SELF-review; the same model on a different
  endpoint still warns, because separate hardware is not separate judgement — identical
  weights carry identical blind spots. Warning-grade, never a hard failure: a single-model box
  is a legitimate if weaker posture, and doctor reserves hard failures for the runtime itself.
  The check compares settings.model — what Session actually constructs — rather than the
  author lane, which resolves in config but is not yet wired to the runtime; reading it
  would report an independence the loop does not have. Negative control per repo practice,
  stated as the mutation matrix actually measured rather than as a summary: against a mutant
  that always returns ok with a plausible pass detail, the three negative-path tests
  fail — including the one asserting the check is registered in run_doctor, since a check
  nobody calls is the vacuous case for the check itself — while the distinct-reviewer test
  survives, because it is the positive control, not a negative one. The inverse mutant
  (always warn) is caught by exactly that distinct-reviewer test and by nothing else. So the
  four tests pin the check in both directions, with no single test doing both jobs. (A weaker
  always-ok mutant carrying a placeholder detail string fails all four, which is why the
  first pass of this note over-claimed a 4-of-4 kill; CodeRabbit caught it on review.)
  Verified on hardware both ways — a clean HOME with no config fires
  the warning out of the box; a configured two-box coder/judge split passes.
  Docs: docs/CONFIG.md §[roles.review] gains an Independence note.
  Known limit: doctor reports this, the loop does not — a run that never invokes
  pxx doctor still gets a blocking gate it cannot fail. Making BLOCKING mode itself
  refuse, or require an explicit allow_self_review opt-in, is carded and not in this release.