Reviewer-agent gate: independent adversarial review before a task surfaces to the operator

[MJohnson459]

Adds a mandatory adversarial review step to the dispatch prompt, running inside
the dispatched session before the agent may call voro done. Prompt text only:
no state-machine, schema, config, or session-machinery change, and Voro's
posture is untouched — it launches no reviewer, records no verdict, and is still
only told the outcome.

What changed

crates/voro/src/dispatch.rs gains REVIEW_GATE_TEMPLATE, a named constant with
a doc comment beside the branch and document blocks, rendered unconditionally by
render_preamble into the {review} slot of the return-path preamble — so every
dispatch carries it and a redispatch inherits it, with and without an assigned
branch, with and without linked docs. It renders through the single-pass
substituter with its own {task_id}/{db} bindings, like the branch block, so a
{task_id} inside it is filled rather than reaching the agent raw. It sits last
in the preamble, after the document list and ahead of the body separator. The
planning and refine prompts render nothing of it.

The block tells the agent to commit, then have the work read by a reviewer with
no authorship context — the harness's own subagent where it has one (in Claude
Code, the Agent tool), a deliberate separate pass where it has none. The
reviewer's inputs are the task body plus its linked documents and the diff of the
work branch against the base, explicitly not the session transcript or the
agent's notes, and its brief is adversarial: grounds to reject against the body's
acceptance criteria, not confirmation. Every finding is fixed or rebutted with
evidence in one pass per done; a fixed finding needs no record, a rebutted one
goes in the --summary with its rebuttal, since that is a judgement the operator
should see and the summary is what voro pr publishes as the PR body.

DESIGN.md §8 describes the step in the return-path prose, next to the linked
documents and branch names it renders beside.

Verification

cargo test --workspace (637 tests) and
cargo clippy --workspace --all-targets -- -D warnings pass; cargo fmt --check
is clean. Two new tests: preamble_mandates_an_independent_review_before_done
asserts the block across all four preamble variants under both a default and a
non-default database, reading whitespace-flattened text so the assertions are not
coupled to the constant's line wrapping;
dispatched_prompt_puts_the_review_gate_ahead_of_the_task_body checks placement
against a really-dispatched prompt file rather than the preamble alone, where the
ordering assertion could not fail. planning_and_refine_prompts_carry_no_review_gate
checks all three prose prompts against the same marker list. The rendered preamble
was also printed end-to-end and read for flow.

This task's own work went through the gate it adds: a fresh-context subagent
reviewed the branch diff against this task body and returned twelve findings,
all fixed in the second commit (docs denied to the reviewer, a circular
"in Claude Code, a subagent", a missing --db, no commit-before-review, "one
pass" ambiguous on the reject path, a vacuous placement assertion, wrap-coupled
and asymmetric test assertions, two DESIGN.md overstatements, a duplicated
comment).

One deviation the operator should see

The task body limits the reviewer's inputs to "the task body and the diff". The
review found that this contradicts the linked-documents block sitting beside it,
which says the body assumes those documents — so on a task with a linked plan
the gate would hand the reviewer a brief it cannot fully read. The block
therefore admits the task's linked documents alongside the body, and renders
after the document list so "named above" is true. The exclusion the criterion
exists for — session transcript, agent's notes — is unchanged.