feat(reviewing-prs): native review recovery — one codex reviewer for both species

[SSFSKIM]

Restores the review loop's product core: one native codex exec review --base engine call returning a compact correctness + spec-compliance verdict for BOTH review-worker species, owned by the new substrate script review-engine.sh.

• skills/reviewing-prs/scripts/review-engine.sh: temporary out-of-tree CODEX_HOME, authentication inherited from the caller's effective Codex home, SSL_CERT_FILE, CODEX_CODE_MODE_HOST_PATH, nested-only sandbox_mode=danger-full-access behind a CODEX_SANDBOX check, fixed review policy via developer_instructions, PR/ticket criteria in an explicitly untrusted data file, and rc passthrough
• engine block rewritten around the script; per-species fallbacks merged into one (codex-only reviewer; engine down → ticket stays in-review + ENGINE-UNAVAILABLE marker)
• each review invocation uses unique temporary criteria/findings paths, preventing concurrent reviews of the same PR number from colliding
• sweep retries marker-carrying finished reviewers (retire → re-dispatch); terminal Codex records are retired without signaling stale PIDs
• _codex_launch exports CODEX_CODE_MODE_HOST_PATH
• protocol ORIENT reads diff shape only (--stat)
• engine, dispatch, daemon, and environment-override regression coverage added
• spec + plan + SKILL.md updated

Spec: docs/doperpowers/specs/2026-07-12-native-review-recovery-design.md
Plan: docs/doperpowers/plans/2026-07-12-native-review-recovery.md

[SSFSKIM]

Automated review trail

Engine: native codex exec review via review-engine.sh (gpt-5.6-sol, xhigh), 3 rounds against origin/main...HEAD.

Final verdict: approve. Round 3 reported: “No actionable correctness defects were found in the full change range.”

Findings and routing

Round 1:

• [P1] Terminal reviewer retirement could signal a reused stale PID — FIX NOW. Codex retirement now signals only active (working/blocked) records; red/green regression coverage added. Commit 6fdf073.
• [P2] Engine state polluted the reviewed tree — FIX NOW. Temporary CODEX_HOME moved outside the worktree and cleanup is tested on success/failure. Commit 64e63b8.
• [P2] Custom CODEX_HOME authentication was ignored — FIX NOW. The caller's effective Codex home is captured before replacement and used as the auth source. Commit e8bf287.
• [P2] Default model/effort test inherited supported overrides — FIX NOW. The default-value case now unsets those overrides. Commit e392231.

Round 2:

• [P1] PR-number-only temporary paths could cross-contaminate concurrent reviews — FIX NOW. Each invocation now allocates one unique temporary directory for criteria and all findings rounds. Commit 6d6b750.
• [P1] PR/ticket text was elevated into developer instructions — FIX NOW. Developer instructions now contain fixed review policy only; PR title/body and ticket criteria remain in an explicitly untrusted data file, with adversarial regression coverage. Commit a0c8e82.
• [P2] Daemon environment test inherited worker host-path/token state — FIX NOW. The default-export test clears the relevant variables locally and passes inside the supported Codex-worker environment. Commit f70f8a9.

Round 3: no findings.

Verification

• tests/reviewing-prs/test-review-engine.sh — pass
• tests/reviewing-prs/test-review-dispatch.sh — pass
• tests/orchestrating-daemons/test-codex-scripts.sh — pass
• scripts/lint-shell.sh on all 7 shell files changed by this PR — pass
• scripts/lint-shell.sh --all — baseline failure only in unrelated tests/claude-code/* files (existing SC2155/SC2064/SC2320/SC2088 warnings)
• GitHub merge state: CLEAN
• GitHub checks: no checks reported for reviewing-review

Tier judgment

HUMAN tier; not merged.

• Final verdict clause: met.
• Post-fix size clause: not met — 182 additions and 111 deletions across 9 files relative to the dispatched head (limit: about 150 lines and 5 files).
• Non-default-base clause: not met — PR targets main, the repository default branch.
• Risk-surface clause: not met — authentication handling changed; auth/security is always-on.
• CI clause: not met — the repository reports no checks for this branch.
• Auto-merge is disabled, but observation-mode self-merge eligibility is not reached because the clauses above fail.

PR head reviewed and pushed: f70f8a9dd98d8ef338ceeeb85b612b2ced3ac052. Added confident-ready for human merge. No board writes were made because this PR has no linked ticket.