Fix review handoff drift failure handling

[yvette-carlisle]

Summary

• Treat retained review handoff as a failure-handling lifecycle boundary before retry/no-diff guardrails run.
• Recover trusted handoff drift by rebuilding review orchestration, clearing stale loop guardrail checkpoints, restoring review state, and marking the failed attempt succeeded.
• Fail closed with review_handoff_state_drift when the clean checkpoint/marker evidence is missing, mismatched, diverged, unknown, or in an unsupported tracker state.
• Document the post-review lifecycle boundary in runtime, lane-control, and post-review specs.

Verification

• cargo test -p decodex review_handoff_state_drift -- --nocapture
• cargo test -p decodex handoff_marker_issue_state_is_unsupported -- --nocapture
• cargo test -p decodex handoff_marker_head_ref_mismatches -- --nocapture
• cargo test -p decodex -- --test-threads=1 (1176 passed, 1 ignored before final unsupported-state regression)
• cargo make checks (1177 passed, 1 skipped)

Notes

• npm ci was required locally because the site dependency tree was not installed in this worktree; no dependency files were changed.