fix(review): an anonymous invalid payload is unattributable, not a reviewer named "unnamed reviewer"

Follow-up defect in the reviewer accounting added by e2aec01, found by review
and confirmed by probe before fixing.

validateFindings only WARNS on a missing `reviewer` field, so a payload can
fail schema while carrying no name. ingest then records `reviewer: null`, and
runContract turned that null into the literal reviewer name "unnamed reviewer".

MEASURED before the fix:
  runContract([{findings:[{file:'x.mjs',line:1,rule_key:'NOPE',severity:'MAJOR'}]}],
              {expectedReviewers:['code-correctness-reviewer']})
  -> missing_reviewers = ["unnamed reviewer", "code-correctness-reviewer"]
One failure, two entries, one of them an agent nobody launched. The
`reported.delete(s.reviewer)` line was also inert for that case, since a null
name was never in the set to begin with.

Fix: skipped payloads are split by whether they carry a name. Named ones go to
missing_reviewers as before; anonymous ones increment the new
`unattributable_payloads` count, which forbids ALLOW on its own - so stripping
a reviewer name from a payload cannot restore ALLOW, and the floor does not
depend on the caller passing expectedReviewers. `allow_blocked_by` reports the
two facts separately: `missing-reviewer:<name>` and `unattributable-payload (n)`.

The old behaviour never produced a false ALLOW - it failed in the safe
direction - but it named a reviewer that did not exist, which is the kind of
output an operator would chase.

Iron Law: two failing tests first (double entry; anonymous-payload-alone must
forbid ALLOW), then the fix.

Also verified in this pass, by temporarily adding a fake reason to
UNVERIFIED_REASONS: the prose-vocabulary pin does go red when a reason is
declared in the lib but missing from agents/review-coordinator.md. A pin that
cannot fail is not a pin.

Suite 1034 (1032/0/2) -> 1036 (1034/0/2), 0 failures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/lib/coordinator-contract.test.mjs

@@ -308,3 +308,28 @@ test('suppression vocabulary — the two sets are disjoint and every reason is d
       `reason "${reason}" is declared in the lib but never documented in agents/review-coordinator.md`);
   }
 });
+
+test('runContract — an anonymous invalid payload is unattributable, not a reviewer named "unnamed reviewer"', () => {
+  // `validateFindings` only WARNS on a missing `reviewer`, so a payload can
+  // fail schema while carrying no name. Reporting it as a reviewer name
+  // invents an agent nobody launched, and double-counts with expectedReviewers
+  // when they are in fact the same failure.
+  const result = runContract(
+    [{ findings: [{ file: 'x.mjs', line: 1, rule_key: 'NOPE', severity: 'MAJOR' }] }],
+    { expectedReviewers: ['code-correctness-reviewer'] },
+  );
+  assert.deepEqual(result.missing_reviewers, ['code-correctness-reviewer'],
+    'missing_reviewers carries real names only');
+  assert.equal(result.unattributable_payloads, 1);
+  assert.ok(result.allow_blocked_by.some((x) => x.startsWith('unattributable-payload')));
+  assert.ok(!result.allow_blocked_by.some((x) => x.includes('unnamed reviewer')));
+});
+
+test('runContract — an anonymous invalid payload forbids ALLOW on its own, with no expectedReviewers', () => {
+  // The fail-closed floor must not depend on the caller passing an expected
+  // set: without this, dropping the name from a payload would restore ALLOW.
+  const result = runContract([{ findings: [{ file: 'x.mjs', line: 1, rule_key: 'NOPE', severity: 'MAJOR' }] }]);
+  assert.deepEqual(result.missing_reviewers, []);
+  assert.equal(result.unattributable_payloads, 1);
+  assert.notEqual(result.verdict, 'ALLOW');
+});