fix(pr-review): parallel drafter delegation, generated-file chunk skipping, drafter file-read hard cap

[docker-agent]

Summary

Three coordinated improvements to the PR review pipeline to address the timeout root causes identified in run #25480617546:

RC1 — Generated protobuf files dominated a chunk and caused the drafter to burn 426 read_file calls.
RC2 — Chunks are processed sequentially; 3 chunks × ~10 min = timeout.

---

Option A — Parallel drafter delegation (best-effort)

File: review-pr/agents/pr-review.yaml (root agent, step 4c)

Instruct the root agent to issue all transfer_task delegations in a single tool-call batch instead of one at a time. When the docker-agent framework supports parallel tool execution this reduces total wall-clock time from O(N chunks × per-chunk time) to O(max per-chunk time). If the framework executes them sequentially, behaviour is unchanged — no regression risk.

---

Option B — Drafter file-reading hard limits

File: review-pr/agents/pr-review.yaml (drafter agent guardrails)

The drafter's previous Cap at 10 source file reads was clearly not being respected (426 calls in one run). Replaced with explicit, numbered, mandatory circuit breakers:

Trigger	Action
15 source files read	Hard stop → return review_complete: false
10 reads + zero high-severity bugs found	Early exit → return review_complete: true
3 consecutive not-found reads	Full stop immediately

Added explicit note: these limits override domain-guide instructions to be "systematic" or "thorough" — which was the loophole the model was exploiting.

---

Option C — Skip excluded / auto-generated chunks

Files: review-pr/action.yml, .github/workflows/review-pr.yml, review-pr/agents/pr-review.yaml, review-pr/README.md

New exclude-paths input

# .github/workflows/pr-review.yml
jobs:
  review:
    uses: docker/cagent-action/.github/workflows/review-pr.yml@VERSION
    with:
      exclude-paths: |
        backend/gen/
        frontend/src/gen/

Chunks where every file starts with an excluded prefix are skipped entirely — no drafter delegation, no token spend.

Chunk manifest in agent context

The pre-split chunk manifest (JSON: chunk number → file list) and the exclude-paths value are now appended to the review prompt so the root agent has full visibility before delegating.

Root agent chunk-skip logic (step 4b)

Before each delegation the root agent now checks:

1. Exclude-paths skip — all files in chunk match a listed prefix → skip
2. Generated-file skip — all files end with .pb.go / .pb.ts / _grpc.go / _grpc.ts / .gen.go / .gen.ts / _gen.go AND the chunk contains a Code generated or DO NOT EDIT marker → skip

This directly prevents the session_service.pb.go / sandbox_session.pb.go scenario from the original analysis.

---

Testing

• pnpm build && pnpm lint (biome CI + tsc + actionlint) — ✅ all pass
• No TypeScript source files changed; dist/ is unchanged
• Shell logic in review-pr/action.yml only adds new if blocks with no side-effects when exclude-paths is empty