fix(apm-review-panel): require synchronous fan-out so the panel never ends its turn with empty safe outputs

[Copilot]

Description

PR Review Panel run 27194415500 reported success yet opened a "No Safe Outputs Generated" failure. gh aw audit traced the chain: the orchestrator spawned the CEO synthesizer in background/detached mode and ended its turn before the synthesis returned, so the single add-comment was never emitted.

agent-stdio.log:  "Agent started in background with agent_id: ceo-synthesizer"  → exit 0
agent_output.json: {"items":[]}
safe_outputs:      needs.detection.result == 'success'  → false  (detection skipped → add-comment job never runs)

The apm-review-panel skill never stated that subagent task spawns are blocking, nor that the turn must not end before the comment is written. Fix is prompt-hardening in packages/apm-review-panel/SKILL.md (the copy the workflow pulls from microsoft/apm#main; no workflow recompile needed).

• New invariant — "Synchronous fan-out, never spawn-and-forget": every task spawn (panelists and CEO) must use synchronous mode, never the background/async agent_id variant; documents the empty-output failure chain and the noop fallback.
• Step 5 (CEO synthesizer) + checklist intro: require BLOCKING execution and awaiting the JSON return.
• New step 9 — emission confirmation: verify the add-comment safe-output tool was actually invoked (and did not error) before ending the turn.
• New gotcha: background spawn-and-forget as the canonical "No Safe Outputs Generated" cause.
• Untracked gh aw debug logs accidentally captured under .github/aw/logs/.

Type of change

• Bug fix
• New feature
• Documentation
• Maintenance / refactor

Testing

• Tested locally
• All existing tests pass
• Added tests for new functionality (if applicable)

Prompt-only change to a skill primitive; no code paths or tests exercise SKILL.md content. Verified the checklist still reads coherently (steps 1–9, cross-references intact).

Spec conformance (OpenAPM v0.1)

If this PR changes behaviour that an OpenAPM v0.1 req-XXX covers,
confirm the three-step ritual (see CONTRIBUTING.md "Adding or
changing a normative requirement"):

• Spec edit: docs/src/content/docs/specs/openapm-v0.1.md updated
  (new/changed <a id="req-XXX"></a> anchor + prose + Appendix C
  row).
• Manifest edit: docs/src/content/docs/specs/manifests/openapm-v0.1.requirements.yml
  updated.
• Test edit: a @pytest.mark.req("req-XXX") test under
  tests/spec_conformance/ added or extended.
• CONFORMANCE.{md,json} regenerated via
  uv run --extra dev python -m tests.spec_conformance.gen_statement
  and committed.
• N/A -- this PR does not change OpenAPM-observable behaviour.

[danielmeppiel]

Superseded by #1714, which audited this fix and rebuilt it around a stronger contract: a deterministic "Non-empty turn exit" invariant keyed off gh-aw's own agent_output emptiness detection (with the real, configured noop safe-output as the fallback), rather than LLM self-attestation. Same proximate cause (synchronous fan-out / no spawn-and-forget) is retained. Closing in favor of #1714.