feat(opencode): add risk-adaptive shadow review pool - #839

Purpose

Implement the production-independent part of Task 6 in the OpenCode review-quality plan: risk-adaptive detector routing, bounded OpenCode shadow execution, and independent source-contract verification without GitHub publication authority.

Exact stacked identity

• stacked base branch: feat/opencode-review-decision-envelope (PR feat(opencode): separate semantic and merge decisions #836);
• exact stacked base SHA: c3133887df775605bfca2aaaa8b94094aec609fc;
• branch: feat/opencode-review-shadow-pool;
• exact current RED head: 4fc5d75fe01258bbc469373eafdcc2d8afb55cfa;
• state: Draft / intentional missing-implementation RED.

No check, review, approval, or comment from PR #829, #831, or #836 authorizes this stacked head. If a predecessor moves or integrates, this branch must be reconciled once and every exact-head evidence surface regenerated.

Permanent test-first contract

The current head contains only permanent tests and an exact-head quality workflow. The production planner, executor, verifier, and shell wrapper intentionally do not exist yet, so the first quality run must fail during collection.

The tests require:

• deterministic small/medium/large diff classification;
• low, standard, high, and critical risk tiers;
• one detector plus verifier for low/ordinary work;
• role-specific security, workflow, data-model, numerical, experience, and documentation detectors only when material;
• high/critical independent model diversity and bounded recursive verification;
• fail-closed detector budgets and missing role pools;
• credential-free, content-addressed routing plans;
• fixed non-shell OpenCode CLI invocation with --agent, --model, --variant, --format json, exact evidence files, and bounded per-attempt timeout;
• NVIDIA_NIM_API_KEY mapped only to the child NVIDIA_API_KEY without logging or argument exposure;
• immutable evidence hash, executable, worktree, and output boundaries;
• detector execution before independent verifier execution;
• partial-failure isolation and dependency-failed verifier skips;
• a thin non-publishing shell wrapper with no GitHub mutation path;
• exact-head normalized detector and verifier receipts;
• trusted source-line receipt validation;
• infrastructure-only, stale, unsupported, self-verified, and failed-attempt candidate rejection;
• minimum independent verifier and model-diversity policy;
• deterministic semantic deduplication;
• shadow_findings only, with published_findings=[] and publication disabled;
• strict JSON, strict schemas, stable CLI statuses, atomic outputs, SHA-256 receipts;
• production statement/branch coverage 100% and public production callable docstrings 100%.

Production and writer boundary

This PR must not edit .github/workflows/opencode-review-dispatch.yml, opencode.jsonc, reviewer identities, model credentials, or GitHub publication code. Active central branches still own the dispatch workflow. The shadow runner produces raw attempt artifacts and the verifier produces a non-publishing report only.

A later protected integration slice may wire the proven pool and decision envelope into the dispatch after the writer lease clears and must begin with a separate failing production contract.

Safety and acceptance

• no GitHub comments, reviews, checks, approvals, merges, branch updates, releases, or auto-merge from this pool;
• no arbitrary shell evaluation;
• no COPILOT_GITHUB_TOKEN use;
• no secret value in a routing plan, process argument, output manifest, or log;
• no temporary, one-shot, self-modifying, or write-capable workflow;
• exact-head checkout uses immutable action pins and persisted credentials disabled;
• workflow token remains read-only.

Keep Draft and do not merge until all stacked predecessors integrate, this branch is reconciled onto the exact protected base, all exact-head quality/security/review evidence passes, no valid unresolved finding remains, and a qualifying independent non-author formal approval exists.