feat(ci): add comprehensive Qodo PR-Agent review rules

[chethanuk]

Summary

• Add .pr_agent.toml with 15 repo-specific review rules derived from real bug history, replacing inline extra_instructions in the workflow YAML
• Update pr-review.yml to use ark-code-latest model, add checkout step so PR-Agent reads .pr_agent.toml, and enable auto-describe
• Single source of truth: all review config now lives in .pr_agent.toml, not scattered across YAML env vars

What's in .pr_agent.toml

15 Review Rules (WHEN/THEN/BECAUSE format)

#	Rule	Derived From
R1	Async Discipline — no blocking I/O in async	PR #728
R2	Memory Pipeline Completeness — all 6 categories	Core invariant
R3	Quadratic Reprocessing Guard — no enqueue-in-loop	PR #505
R4	VLM/Embedding API Resilience — timeout + retry	PR #740/#745/#756
R5	Type Safety — ruff/mypy compliance	CI pipeline
R6	License Headers — Apache-2.0 on all source	Convention
R7	Error Handling — no bare except	PR #148f6e3
R8	Plugin Hook Timeout — getClient() protection	PR #749
R9	Process Lifecycle — SIGTERM/cleanup	Bot architecture
R10	API Backward Compatibility — no breaking changes	PR #767
R11	Concurrency Safety — locks on shared state	PR #505 pattern
R12	Retrieval Pipeline Integrity — optional rerank	PR #754
R13	Testing Requirements — regression tests for bugs	Best practice
R14	Documentation Consistency — en/zh/ja sync	PR #755
R15	Telemetry & Observability — get_current_telemetry	PR #735

8 Custom Labels

memory-pipeline, async-change, embedding-vectorization, plugin-bot, api-breaking, multi-tenant, retrieval, rust-cli

Ignore Patterns

Lock files, third_party/**, target/**, db_test_*/**, .worktrees/**, build_support/**

Enabled Features (off by default in Qodo)

• Score review, TODO scan, split-PR detection, security audit
• Improve tool: quality threshold=5, extended mode, parallel calls
• Describe tool: PR diagrams, semantic file types, auto-labels

Workflow Changes

• Model: ark-code-latest via https://ark.cn-beijing.volces.com/api/coding/v3
• Added actions/checkout@v4 so .pr_agent.toml is readable
• Enabled auto_describe
• Removed inline extra_instructions (now in .pr_agent.toml)

Test plan

• Open a test PR to verify Qodo PR-Agent picks up .pr_agent.toml and applies rules
• Verify custom labels appear on PRs touching relevant subsystems
• Confirm ignored files (lock files, third_party) are excluded from review
• Check that the new model endpoint (ark-code-latest) responds correctly

[qin-ctx]

/review

[github-actions]

Preparing review...