fix(skillopt): local-review publish path + downgrade latch on definitive API rejections (#738)

[jerryfane]

Closes #738

Problem

A live training session wedged: its human feedback was already TrainingReady (ranked + pairwise imported via feedback markdown import), but train continue could not reach review_published without a successful GitHub post — and the post 422'd because the review packet exceeds GitHub's 65,536-char issue-body limit. Two root causes.

1. Local-review path in the state machine

publishSkillOptTrainReview now checks loadSkillOptReviewStatus for the iteration's eval run before attempting the GitHub post. If status.TrainingReady is already true, it records the review against the local surface (metadata {status: published, review_surface: local}), registers no GitHub watch, transitions to review_published, and returns a LocalSurface result. The next train continue hop takes the existing TrainingReady -> feedback_synced path.

• The check runs before recoverSkillOptTrainReviewPublication, so it also unwedges a session left with a stale posting_external marker.
• A pending published_external recovery marker (a real GitHub post that only needs a state-resume) is still honored via recover, not shadowed by a local record.
• When feedback is not yet ready, behavior is byte-identical: GitHub stays the default surface (publish-first / sync-skipped-after preserved).

2. Latch downgrade for definitive rejections

Extends #735's downgradeReviewMarkerOnLaunchFailure: a definitive 4xx API rejection (HTTP 422 validation / 404 / 403) — which proves no issue was created — now also downgrades the posting_external marker (status failed_external_rejected) so the retry proceeds. Ambiguous failures (timeouts, kills, 5xx, socket drops) keep the conservative latch. Grounded in a new github.IsDefinitiveRejectionMessage classifier that sits alongside IsTransientMessage (disjoint 4xx vs 5xx/transport signature sets).

3. Size-aware degradation (nice-to-have)

Left as a code TODO(#738 part 3) at the publish site — non-trivial (summary issue + trailing comments/artifact). Parts 1+2 already resolve the wedge for the reported scenario.

Tests (deterministic, no network)

• TestSkillOptTrainContinueLocalReviewSkipsGitHub — TrainingReady-before-publish → continue skips GitHub (no client constructed), metadata carries review_surface: local, state → review_published, no watch registered.
• TestSkillOptTrainContinuePublishesToGitHubWhenFeedbackNotReady — not-ready → GitHub publish path invoked exactly as before (regression).
• TestDowngradeReviewMarkerOnDefinitiveRejection — 422/404/403 downgrade + retry proceeds; 5xx/timeout/killed/socket preserve the latch.
• TestSkillOptTrainContinueLocalReviewEndToEnd — full local path: seeded options_generated with imported TrainingReady feedback → two continue hops reach feedback_synced with zero GitHub calls.
• TestIsDefinitiveRejectionMessage (internal/github) — classifier unit coverage.

Gate

• go build ./... OK
• go vet ./... OK
• go test -count=1 ./internal/cli/ OK (211.99s)
• go test -count=1 ./internal/github/ OK; go test -race ./internal/github/ OK
• scoped -race on the new cli tests OK

🤖 Generated with Claude Code