feat: add versioned review configuration

[EmersonBraun]

Summary

• Adds strict .agentskit-review.json with configVersion: 1.
• Resolves built-in lens policy, thresholds, budgets, retries, conventions, context policy, and execution metadata with flags taking precedence.
• Keeps provider/model/transport/trust/redaction/permissions out of project-controlled CI configuration; secrets are rejected and diagnostics are value-free.
• Adds explicit local-only incomplete-profile handling: output is COMMENT and exit 2, never approval.
• Documents the contract and adds unit plus CLI end-to-end coverage.

Validation

• npm run check
• npm pack --dry-run
• 38/38 tests passing

Scope boundary

Runtime enforcement of byte/call/retry/context budgets is intentionally consumed by the follow-up issues #44 and #45; this PR establishes and validates their versioned policy input without silently adding a second execution path.

Closes #39