feat(review): the review is a gate - verdict in the file, CC engine, project memory

Ordre 5 (wave 1, P11 + P5), review_version 1.1.

- K7: `verdict: ALLOW | WARN | BLOCK` is required in review.md (strict
  error, soft warning for 1.0 reviews). New CLI lib/review/verdict-gate.mjs:
  0 = ALLOW/WARN, 1 = BLOCK, 2 = could not decide (never green); a verdict
  greener than the file's own BLOCKERs or JSON block is exit 2. Realpath
  main guard (the old file:// guard exits 0 under a symlink - measured).
- No finding is struck for length: succinctness trims only MINOR/SUGGESTION
  text (catalogue tier), keeps BLOCKER/MAJOR whole, counts trims; the
  coordinator lists what it declined to judge.
- Claude Code's /code-review and /security-review run as the engine via the
  Skill tool (never --fix/--comment/--post/ultra); lib/review/engine-findings.mjs
  turns their findings into a reviewer payload; two catalogue keys
  (CODE_REVIEW_DEFECT, SECURITY_REVIEW_VULNERABILITY), catalogue 12 -> 14.
  An engine that did not run forbids ALLOW.
- Every BLOCKER is written as a numbered `### Step R<n>` with its source
  finding (strict error REVIEW_MISSING_REMEDIATION_STEP).
- P5: lib/review/recurrence.mjs - a finding class in two review.md files
  (current + git history, no new store) becomes one proposal, routed by the
  catalogue's memory_route; written only between Voyage markers in
  .claude/rules/voyage-review-lessons.md under a size budget, CLAUDE.md gets
  a pointer only; the operator approves every line (Phase 8.7).
- Workflow substrate: catalogue enum in step; a missing reviewer or engine
  forbids ALLOW there too (it returned ALLOW on zero findings before).
- Fixtures review-run-A/B said WARN over a BLOCKER; now BLOCK.

Borrowed and credited in code: Superpowers (declined-to-judge), ai-native-sdlc
(cap only nits; mistake/fix/check), Spec Kit (managed block; converge steps),
Pocock (retro routing), Kiro (verdict file + gate; evidence per lesson),
Cherny (engine -> brief control order; review -> memory; budget).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/lib/doc-consistency.test.mjs

@@ -209,11 +209,12 @@ test('HANDOVER-CONTRACTS.md contains Handover 7 section (session-state)', () =>
 });
 
 test('review-validator has CLI shim', () => {
+  // Ordre 5: the realpath form (no-op-free under a symlink or a space); the run
+  // through a symlink is proven in tests/validators/review-validator.test.mjs.
   const text = read('lib/validators/review-validator.mjs');
   assert.ok(
-    text.includes('import.meta.url === '),
-    'lib/validators/review-validator.mjs should expose the standard CLI shim ' +
-    '(if (import.meta.url === `file://${process.argv[1]}`)) so commands can call it from Bash',
+    text.includes('realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))'),
+    'lib/validators/review-validator.mjs should expose the realpath CLI shim so commands can call it from Bash',
   );
 });
 
@@ -268,12 +269,12 @@ test('HANDOVER-CONTRACTS.md Handover 7 § Lifecycle names --cleanup and produced
 // file" (commands/trekcontinue.md exists, so that loop already asserts the
 // /trekcontinue reference). Single-command existence pin → redundant.
 
-test('rule-catalogue has exactly 12 entries', async () => {
+test('rule-catalogue has exactly 14 entries', async () => {
   const mod = await import('../../lib/review/rule-catalogue.mjs');
   assert.strictEqual(
     mod.RULE_CATALOGUE.length,
-    12,
-    'lib/review/rule-catalogue.mjs RULE_CATALOGUE size invariant: must be 12 (v1.0 baseline)',
+    14,
+    'lib/review/rule-catalogue.mjs RULE_CATALOGUE size invariant: must be 14 (12 v1.0 baseline + 2 engine keys, ordre 5)',
   );
 });