fix(review): close the gate's fail-open paths an independent review found

An adversarial read of d88245c reproduced 15 problems; all fixed here, each
with a test that fails on the old code.

- verdict-gate: a greener verdict must be backed by the LAST fence being a
  `json` block of the right shape, with no BLOCKER in the JSON (any case),
  in `## Findings (BLOCKER)`, or a differing finding-id list; two verdict
  lines and more than one file argument are exit 2. ({}, null, lowercase
  "blocker", a trailing ```jsonc and a later json fence all gave exit 0.)
- engine-findings: a transcribed "narrower" key can no longer lower an
  engine tier; absolute paths under --repo-root match the scope; "12" lines
  parse; an empty scope is an error; out-of-scope engine findings are
  unverified (`engine:out-of-scope`) and forbid ALLOW.
- recurrence: the catch-all engine keys and keys normalised from unknown
  ones are never proposed; the same unfixed finding in two iterations is not
  a recurrence; proposals are validated before they are offered; \r/U+2028
  and damaged markers are refused; writes go through a symlinked CLAUDE.md.
  Prose points --repo at the session directory, not the git toplevel.
- Workflow substrate: engines are counted from what arrived, and the
  verdict's floor is recomputed from the coordinator's findings; now tested
  by running the script with stubbed Workflow globals. Two literal NUL bytes
  written as \u0000 (git saw the file as binary).
- Trimming keeps Pass 1's "Also flagged by" provenance; `## Declined to
  Judge` and remediation steps are required from review_version 1.1 only
  (N-1); the zero-diff review now carries the JSON block the gate needs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/validators/review-validator.test.mjs

@@ -150,7 +150,9 @@ test('validateReview — a verdict outside ALLOW|WARN|BLOCK is an error in both
 // ---- A BLOCKER is written as a plan step Handover 6 can append (ordre 5) ----
 
 const BLOCKER_ID = '763d174e6c519fafbadcba5d1706708479e36e61';
-const WITH_BLOCKER = GOOD_REVIEW.replace('verdict: ALLOW', 'verdict: BLOCK') + `
+const WITH_BLOCKER = GOOD_REVIEW.replace('verdict: ALLOW', 'verdict: BLOCK')
+  .replace('review_version: "1.0"', 'review_version: "1.1"')
+  .replace('## Remediation Summary', '## Declined to Judge\n\nNone.\n\nTrimmed: 0\n\n## Remediation Summary') + `
 \`\`\`json
 {"verdict": "BLOCK", "counts": {"BLOCKER": 1, "MAJOR": 0, "MINOR": 0, "SUGGESTION": 0},
  "findings": [{"id": "${BLOCKER_ID}", "severity": "BLOCKER", "rule_key": "UNIMPLEMENTED_CRITERION", "file": "lib/login.mjs", "line": 23}]}
@@ -178,6 +180,11 @@ test('validateReview — strict: a BLOCKER with its "Step R1 … Source finding"
   assert.equal(r.valid, true, JSON.stringify(r.errors));
 });
 
+test('validateReview — a 1.0 review with a BLOCKER is not held to the 1.1 remediation-step rule (N-1)', () => {
+  const v10 = WITH_BLOCKER.replace('review_version: "1.1"', 'review_version: "1.0"');
+  assert.equal(validateReviewContent(v10, { strict: true }).valid, true);
+});
+
 test('validateReview — soft: a missing remediation step only warns', () => {
   const r = validateReviewContent(WITH_BLOCKER, { strict: false });
   assert.equal(r.valid, true);
@@ -191,6 +198,16 @@ test('validateReview — a clean review with zero findings validates with `findi
   assert.equal(validateReviewContent(GOOD_REVIEW.replace(ids, 'findings:\n'), { strict: true }).valid, false);
 });
 
+test('validateReview — strict: a 1.1 review needs ## Declined to Judge; a 1.0 review does not', () => {
+  const v11 = GOOD_REVIEW.replace('review_version: "1.0"', 'review_version: "1.1"');
+  const r = validateReviewContent(v11, { strict: true });
+  assert.equal(r.valid, false);
+  assert.ok(r.errors.find(e => e.code === 'REVIEW_MISSING_SECTION' && /Declined to Judge/.test(e.message)));
+  const fixed = v11.replace('## Remediation Summary', '## Declined to Judge\n\nNone.\n\nTrimmed: 0\n\n## Remediation Summary');
+  assert.equal(validateReviewContent(fixed, { strict: true }).valid, true);
+  assert.equal(validateReviewContent(GOOD_REVIEW, { strict: true }).valid, true, '1.0 stays valid');
+});
+
 test('review-validator CLI — run through a symlink and a path with a space it still validates (exit 1, not a silent 0)', () => {
   const dir = mkdtempSync(join(tmpdir(), 'review validator '));
   try {