feat: review findings, dismiss, undismiss and feedback commands

[Peyton-Spencer]

Stacked on #72 (codex/review-cli); needs ditto-assistant/backend#3196 (on top of backend#3186) deployed first. DITTO-178, child of the DITTO-177 epic.

Ditto Review already records console feedback and dismissals as learning data, and a console dismissal replies on the GitHub thread and resolves it. None of that was reachable from a terminal, so agents and people triaging findings fell back to plain GitHub replies, which record nothing. These commands go through the same routes the console uses.

Commands

heyditto review findings <pr-url | owner/name#N | run-id> [--all] [--org] [--output json]
heyditto review dismiss  <finding> --reason "…" [--pr <pr>]          # managers
heyditto review undismiss <finding> [--pr <pr>]                        # managers
heyditto review feedback <finding> useful|wrong|not_useful [--note "…"] [--pr <pr>]

A finding is named the way a person meets it: the GitHub review comment's URL (…/pull/12#discussion_r<id>), <run-id>:<finding-id>, or a bare finding id with --pr. findings reads the PR's newest run through the new GET /api/v5/review/runs/latest?repository=&pr=; a comment URL is matched against each finding's commentUrl. Without --org (and no stored default) the PR's repository is looked up in the personal workspace and then each organization the key can see, because a GitHub URL already names the repository.

Output states what happened on GitHub (replied and resolved, nothing to update, pending, marker conflict, or failed with the server's reason and a retry hint) and prints the undo command. Validation (missing reason, PR URL instead of a comment URL, bare id without --pr, unknown verdict) happens before any request.

Validation

• npm run check, npm run build and node --test test/review-commands.test.mjs pass on debby (Node 20) at 21b8793: 20/20, the 13 lifecycle tests from feat: add ditto review run lifecycle commands #72 plus 7 new ones (workspace fallback order, --all --output json, dismiss by comment URL with the posted body, pre-request refusals, a comment missing from the newest run, feedback by bare id + --pr, undismiss by run:finding).
• The full npm test on debby shows the same 8 pre-existing fixture failures feat: add ditto review run lifecycle commands #72's description reports (installed harness binaries, default git branch); they are unrelated to this change and pass on the Node 24 CI runner.
• Not exercised here: a live run against production, which needs backend#3196 deployed. Planned before release.

Merge order

backend#3186 → backend#3196 → #72 → this PR (squash; the title is the release commit).

🤖 Generated with Claude Code