calibration: wire ai_review_close_confidence override consumption and flip the knob to live

[JSONbored]

Problem

#8159 registered ai_review_close_confidence as a REPORT-ONLY loosenable knob: backtest-cleared proposals (from the real ai_consensus_defect corpus) surface in the advisor with full evidence, but nothing can apply them — no override consumer exists. Wiring one is a gate-authority change (a loosened close confidence means more auto-closes), so it was deliberately excluded from the registry PR.

Requirements

⚠️ Required pattern. Mirror the satisfaction floor's consumption chain exactly: a validated, bounds-checked read (loosening-only: below DEFAULT_AI_REVIEW_CLOSE_CONFIDENCE, at/above the knob's 0.85 hard minimum; anything else ⇒ shipped default) resolved at ONE point, threaded as a defaulted parameter — never a mutable global.

• Consumption point: the policy.aiReviewCloseConfidence ?? DEFAULT_AI_REVIEW_CLOSE_CONFIDENCE fallbacks (isConfiguredGateBlocker's sub-floor disposition path and resolveAiReviewLowConfidenceHold, host + engine twin). An explicit per-repo aiReviewCloseConfidence setting must ALWAYS win over the global override — the knob only moves the default.
• Flip the registry entry to applyMode: "live" ONLY in this PR, together with the generic apply path (per-knob system_flags key, audit event, one-shot alert — reuse the satisfaction machinery generalized, not duplicated).
• The calibration: operator visibility for applied loosenings — live floor + history on the internal calibration surface #8161 status surface generalizes to show this knob's live value + history.

Deliverables

• Bounds-validated override read + threading through both gate-decision twins (parity checks green)
• Generic apply path + registry flip to live, with the same double flag-gating as the satisfaction loop
• Status-surface coverage + 99%+ branch-covered tests on every touched src path

Links & Resources

#8159 (the registry), #8121 (the discipline), src/services/loosening-knobs.ts, src/rules/advisory.ts + packages/loopover-engine/src/advisory/gate-advisory.ts (the twins)

Boundaries

Per-repo explicit settings always beat the global override. No other knob goes live in this PR. Trust-critical: gate authority changes only through the full backtest gate.

maintainer-only — gate-authority consumption plumbing.

[linear-code]

JSO-5680