feat(pr-review): auto-fix findings and rebuild the review presentation

[NagyVikt]

Summary

• feat(pr-review): auto-fix findings and rebuild the review presentation
• chore(deps): bump postcss and next in /frontend (chore(deps): bump postcss and next in /frontend #690)

Test plan

• verified locally

[NagyVikt]

Code review — PR #693

Decision: APPROVE with comments — 0 CRITICAL, 0 HIGH, 2 MEDIUM, 2 LOW.

Validation

Check	Result
Lint (biome 1.9.4, pinned)	Pass — 187 files, no findings
Tests (npm test)	786/828 pass, 41 fail — failing set byte-identical to main (pre-existing baseline red), 1 skipped
node --check bin/multiagent-safety.js	Pass
bash scripts/check-script-symlinks.sh	Pass — 14 pairs
openspec validate <change> --type change --strict	Pass
openspec validate --specs	Pass — 133/133

Correctness properties verified

• The gate decides on all findings, not the posted subset. runPrReview returns every normalized finding regardless of anchoring or dedupe, and evaluate(review.findings) consumes that. So demoting a finding out of the inline view, or skipping it as a duplicate, can never soften the merge gate.
• New flags never reach the shell script. gx finish builds finishArgs from an explicit allowlist (src/finish/index.js:451); gx branch finish strips them in splitGateReviewFlags. Confirmed empirically: passing --gate-autofix to the script surfaces no unknown-argument error.
• Auto-fix cannot write to the wrong place. Four independent guards: protected-branch refusal, uncommitted-tracked-edits refusal, expectBranch pin, and explicit path staging (never add -A).
• The fixer never certifies itself. The gate loop always re-invokes runPrReview after a fix; the fix result is never used as the verdict.

MEDIUM

1. src/pr-review.js — postGithubReview treats any non-zero POST status as an anchoring failure and retries summary-only, reporting "inline anchoring rejected by GitHub". A transient 5xx or network blip therefore loses the inline comments and prints a misleading cause. Behavior is still safe (the review posts, the gate is unaffected); the message is just wrong for non-422 failures. Distinguishing 422 from other statuses would need the response body, which gh api writes to stderr — a follow-up.

2. src/review-fix.js — a fix that touches a very large number of files stages them in one git add -- <paths> argv. Well under Linux ARG_MAX for any realistic fix, but unbounded in principle.

LOW

3. src/review-diff.js:12 — GIT_HEADER_RE is greedy; a path literally containing b/ would split at the wrong point. Backtracking resolves the normal case correctly, and +++ b/<path> overrides the provisional value whenever git emits it.

4. src/review-fix.js — commitMessage does not cap per-finding body line length, so a verbose finding produces a long commit-body line.

Notes

• All new behavior is opt-in: --fix, --gate-autofix, --gate-autofix-rounds default off. The only unconditional change to existing runs is the review presentation plus the anchoring/dedupe safety, both of which strictly reduce failure modes.
• extractJsonPayload reordering (raw JSON before fence extraction) fixes a live bug found by the new tests: valid JSON whose suggestion contains a code fence previously parsed as the fence contents.