fix(argus): /tmp verdict files, tolerant parsing, inline security scrutiny

[andybevan-scope3]

Follow-up to #2349 (arbiter split). Fixes four review findings — common thread: several degrade paths failed open, letting a recorded request-changes silently become a non-blocking COMMENT (re-creating the stall #2349 fixed).

.github/ only (dev tooling) — no changeset needed. Because this PR modifies the review workflow, Argus won't auto-review it (paths-ignore + workflow-mod gate); a human merges it.

Findings addressed

1. (HIGH) Verdict/body files used an unproven write path. Moved the four agent-written paths from ${{ runner.temp }} (outside GITHUB_WORKSPACE, never validated as writable by the reviewer's Write tool) to /tmp — the path the old prompt proved works. If Write had refused runner.temp, arbiter tier 1 would always fail → every PR degrades to COMMENT → Argus never approves. Added a log-visible probe when neither file is written. (POST_FILE also moved to /tmp for consistency; it's bash-written so it was never at risk.)
2. (MED-HIGH) Prompt still said "Consult security-reviewer" in MUST-FIX Fix Fly.io deployment timeout issues #2 and Set up conductor.json #9 after ci(argus): post via a deterministic arbiter; review inline #2349 removed the Task tool. Reworded both to inline security-grade scrutiny so the agent doesn't burn turns trying to spawn a subagent it can no longer create.
3. (MED-HIGH) Verdict parser failed open. A decorated request-changes (backticks, request changes, trailing punctuation) matched no exact token → EVENT="" → posted as a non-blocking COMMENT. Now matches request-changes synonyms first (*request*chang*|*reject*|*block* → fail closed), with a bounded head -c 200 read.
4. (MED) Valid verdict + empty body dropped to COMMENT. If the verdict wrote but the body write failed / hit --max-turns, a real request-changes was degraded. Now posts under the verdict with a placeholder body; the tier-2 preamble distinguishes "no verdict recorded" from "verdict recorded but the post failed."

Verification

• npm run lint:workflows → passed (16 files)
• js-yaml parse of ai-review.yml → ok
• bash -n on the extracted arbiter script → ok
• Prompt greps: no stale Consult|Delegate|-reviewer|-expert; all gh pr review / Task hits are prohibitions
• All four env paths confirmed /tmp

The real proof (reviewer no longer stalls, arbiter posts the right verdict) only comes from a live CI run on a source-code PR after this merges — pull_request_target runs the reviewer/prompt from the base SHA.

🤖 Generated with Claude Code