ci(argus): post via a deterministic arbiter; review inline

[andybevan-scope3]

Why

The Argus reviewer stalls on source-code PRs and never posts an approval — they sit at REVIEW_REQUIRED while a fallback drops a non-approval COMMENT. Diagnosis (three runs on #2345 vs a working run on #2333 and Brian's #2346):

• Argus is a single agent that must both run its Task sub-reviewers and call gh pr review itself.
• On source PRs it dispatches the subagents, then ends its turn early ("waiting for the experts to report") before posting. Posting is the last thing it does, so nothing lands.
• Config/docs PRs skip subagents (the prompt's skip-everything list), so they post fine — which is why maintainer PRs like Migrate conductor.json to .conductor/settings.toml #2346 approve and source PRs don't. It's not an author-permission issue (the PR author has write; the actor gate passes).

What Changed

Split the flow into reviewer → arbiter, mirroring how Argus v2 works (posting decoupled from the reviewer):

• Reviewer writes its verdict (approve/comment/request-changes) and review body to two files (ARGUS_VERDICT, ARGUS_REVIEW_BODY); it no longer calls gh pr review.
• Post review (arbiter) — a new deterministic bash step reads those files and posts the review. Degrades safely in tiers: valid verdict+body → post it; body only → COMMENT; agent final text → COMMENT; nothing → a plain note. Never fabricates an approval. Replaces the old verify + fallback + failure-comment steps.
• Inline review, no Task. Removed the mandatory subagent dispatch and dropped Task + gh pr review from the tool allowlist. The reviewer reads the diff and files itself. This removes the stall trigger and the permission denials; fix: strip pricing_currencies from get_products for AdCP 3.0 sellers #2333 shows the subagents weren't adding value (it approved despite 13 denials, i.e. they were failing). Domain-scrutiny guidance is preserved inline.

Notes / testing

• This PR is intentionally not auto-reviewed by Argus — it touches .github/ai-review/** + the workflow, which both paths-ignore and the workflow-mod gate exclude. Needs a human review/merge (no chicken-and-egg).
• pull_request_target runs the reviewer/prompt from the base SHA, so the new behavior only takes effect after this merges to main. It can't be exercised on an open PR beforehand. Validated pre-merge via npm run lint:workflows, YAML parse, and logic review; the live proof is the next Argus run on a source-code PR after merge.

🤖 Generated with Claude Code