fix(foreman/executor): route reviewer-role GO through modelDecidedResult

[Defilan]

What

Routes reviewer-role Agents' verdict=GO through modelDecidedResult instead of the HasChanges → Commit → Push flow that coder Agents take.

Why

Fixes #543

Reviewer Agents are read-only by design (Agent.spec.tools excludes write_file and str_replace), so they never produce workspace changes. When such an Agent submits verdict="GO" meaning APPROVE, the existing executor's GO branch hit HasChanges == false and fell through to noChangesResult, which downgraded the verdict to NO-GO with summary "model emitted GO but produced no diff" and dropped the model's submit_result.extra payload (reviewOutcome, findings, issueAsk, filesTouched, etc.) on the floor. The structured review survived only in the transcript ConfigMap.

Surfaced cleanly by the M5-lite reviewer demo on 2026-05-25: review-449, review-506, review-510 all emitted GO/APPROVE with 3-5 structured findings each, all got recorded as NO-GO no-diff at the AgenticTask level. Reviewer model behavior was correct; executor was discarding the output.

How

One-line change in pkg/foreman/agent/executor_native.go at the verdict-handling branch in runLLMPath: condition now reads "non-GO verdict OR reviewer-role Agent" and routes both to modelDecidedResult. The non-reviewer GO path (coder commit + push) is untouched.

if verdict != foremanv1alpha1.AgenticTaskVerdictGo ||
    agent.Spec.Role == foremanv1alpha1.AgentRoleReviewer {
    return e.modelDecidedResult(start, transcriptRef, loopRes, verdict), nil
}

Strict role check (not "Agent's tools lack write_file") so the contract is explicit in the CR and obvious to users modeling pipelines. Future Agent roles get their own path if they need one; this PR doesn't make assumptions about them.

Adds a regression test TestNativeExecutor_ReviewerGoIsApproveNotCommit that constructs a reviewer-role Agent with a read-only tool whitelist, has the fake loop submit GO with realistic structured extra (mirroring the v5 reviewer payload: reviewOutcome=APPROVE, two findings, issueAsk verbatim quote, filesTouched), and asserts:

• res.Verdict == GO (not downgraded)
• res.Extra["outcome"] == "MODEL-DECIDED" (not "NO-CHANGES")
• res.Extra["modelExtra"] round-trips with reviewOutcome, findings, issueAsk intact
• No branch is pushed to the bare remote (reviewers never push)
• Transcript ConfigMap still gets written

Checklist

• Tests added/updated (regression test for [BUG] executor downgrades reviewer Agent's APPROVE verdict to NO-GO no-diff #543)
• make test passes locally
• make lint passes locally
• Commit messages follow conventional commits
• All commits are signed off (git commit -s) per DCO
• Documentation updated (n/a, internal behavior change)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!