fix: close what an independent review found in the trial 2 fixes

- The pre-compact hook read only a checkpoint that started with `git commit`,
  so every plan in the new `git add … && git commit` form rebuilt nothing, and
  an empty match also skipped the session-state refresh. It now finds the
  commit anywhere in the span and always refreshes; first test for the hook.
- A sub-bullet that carries its own command stays a criterion (folding it
  left the command unrun); the shallowest bullet sets the base indent.
- Only a MINOR/SUGGESTION /code-review finding outside the range is released
  from forbidding ALLOW: a MAJOR one may be a break cited at an unchanged
  caller.
- `reuse` is an improvement category; the session-spec template stages too;
  a negated bash 3.2 constraint, an env prefix and `bash -c` are handled.
- Stale comment, Declined-to-Judge wording and rule-key counts brought in line.

Tests fail on 7c11c2a first (9 of 24).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

commands/trekreview.md

@@ -308,7 +308,7 @@ later in this conversation. Do not start Phase 6 before both engines have
 delivered or have been recorded as not run. For each engine that delivered,
 transcribe every finding — file, line (0 when none), the one-sentence summary,
 the failure scenario, the category if given (it decides the tier:
-`simplification`, `efficiency`, `style` and `readability` enter as MINOR), the
+`simplification`, `efficiency`, `reuse`, `style` and `readability` enter as MINOR), the
 fix the engine proposes (`fix`) only when its text states one — never write one
 the engine did not give — and a narrower catalogue `rule_key` only when one
 plainly fits — into
@@ -329,11 +329,11 @@ Exit 0 prints a reviewer payload (`claude-code-review` /
 files outside the review's SHA range (`/security-review` diffs against
 origin's default branch, which can be wider). Pass `out_of_scope` to the
 coordinator as well: each one is listed under `## Declined to Judge`
-(`engine:out-of-scope`) and in Coverage — never silently dropped. One from
-`/security-review` is `unverified` and forbids `ALLOW`: its base is wider than
-this review and nobody here judged it. One from `/code-review` does not hold
-`ALLOW` back: that engine was given exactly this range, so a citation outside
-it is a remark about code this review did not change. Absolute paths under the repo root are made relative
+(`engine:out-of-scope`) and in Coverage — never silently dropped. It is
+`unverified` and forbids `ALLOW` — with one exception: a MINOR or SUGGESTION
+from `/code-review`, which was given exactly this range, is an improvement to
+code this review did not change and does not hold `ALLOW` back. A MAJOR one
+still does: a change that breaks an unchanged caller is cited at the caller. Absolute paths under the repo root are made relative
 before the scope match (`--repo-root`). Exit 1 = the transcription is
 malformed, or the scope list is empty: fix it from the engine's own text (or
 the scope from Phase 3) and re-run; never feed a payload that did not pass.