feat: add ditto review run lifecycle commands

[Peyton-Spencer]

Ditto Review only exposed repository listing/settings in the CLI. Add review runs, pulls, start, status, watch, retry, and cancel, with organization scope and JSON output. Watch progress goes to stderr and produces one final JSON document; timeouts stop only the local watcher, while failed reviews return a nonzero exit code. Start/retry help states the existing per-run budget and re-review cost semantics.

Requires https://github.com/ditto-assistant/backend/pull/3186 to deploy first: current production accepts CLI keys for Review listing/settings but refuses the lifecycle routes with 401. That backend PR grants only the exact methods/complete paths these commands use, retaining workspace and manager authorization. These lifecycle commands are not yet released or verified against the changed production API.

Validation: npm run verify passed all 260 tests, TypeScript check/build, and package dry-run locally and on Node 24 CI at head cbdfa89fecece612a4a1ba2c8aadadc646886c95: https://github.com/ditto-assistant/ditto-cli/actions/runs/37054253645. Focused Review tests passed 13/13 after restoring the fixed source. A negative control built the previous Review implementation with the new tests: four start/watch regression checks failed as expected. The independent input-validation check also passed on the baseline and is not counted as regression evidence. Added a PR verification workflow. Its first run exposed two existing fixture assumptions: installed harness binaries and the machine's default Git branch. The auth test now supplies fake binaries and asserts neither launches, and the bare upstream fixture explicitly starts on main.

Live check-run proof (separate from the new CLI lifecycle routes): triggered @ditto review on console #88 after backend #3184 deployed. GitHub check 110987808682 transitioned from in_progress to completed/success, matched run cf61c226-7c66-4b8e-88b5-69736b5788b2 and head 2bb7db7a68e55b16eb94b7dc9a8caacd95681ea1, and linked to the published review with 11 findings. This validates progress reporting and publication, not the accuracy of those findings. Existing $1 per-run cap; billed $0.138613815.

Note

Add ditto review run lifecycle commands

• Adds review runs, pulls, start, status, watch, retry, and cancel commands in review-commands.ts, with text and JSON output and organization scoping.
• review start submits one request and --watch follows the returned run by polling run details until a terminal state (completed, partial, failed, cancelled, skipped, superseded). Failed runs set a nonzero exit code.
• Watchers enforce bounded polling intervals (1-60s) and local timeouts (up to 86,400s). Local timeouts report that the server-side review continues.
• apiFetch in api.ts accepts an AbortSignal so polling requests are abortable; run IDs are validated as UUIDs before any API call.
• Extends test coverage in review-commands.test.mjs for all lifecycle commands, including refusal, timeout, and terminal-state cases. Also documents the new commands in README.md and adds a PR verification workflow in ci.yml.
• Behavioral Change: repositories are now resolved case-insensitively against the workspace Review configuration; repositories not configured for Review are rejected.

^{Macroscope summarized cbdfa89.}