feat(ai-review): isolate analysis from validated GitHub publishing

[absorbb]

Codex currently posts directly to GitHub with a write-capable App token. Split analysis from publication so the model returns structured findings under read-only GitHub permissions, and a fresh runner validates and publishes the result.

The publisher requires an explicit completed review for the exact SHA, validates paths and inline ranges against the rename-aware Git diff, deduplicates its own finding markers, and rechecks that the PR is open, non-draft, and still at the reviewed head immediately before posting. Native PR reviews retain APPROVE with inline findings; commit mode retains a single consolidated comment. Invalid, missing, incomplete, stale, or failed output fails the workflow instead of being treated as an empty review.

Intentional decisions and tradeoffs

• PR 2 only: model (gpt-5.6-terra), effort, CLI/action pins, review scope, and approval convention remain unchanged. Incremental review belongs to PR 3.
• Analysis and publication use different runners. Analysis has no App key/posting token, and checkout credentials are not persisted. The App token is minted only after validation.
• Trusted publisher code is embedded in the workflow because reusable callers do not contain this repository's scripts. Artifacts are parsed as data and never executed.
• Exact own-bot fingerprints prevent duplicate findings even if lines move; semantic/legacy deduplication still uses the prompt's prior-thread context.
• Concurrency covers the full pipeline to serialize duplicate checks and posting. Analysis exports its artifact identity so rerunning only a failed publisher retrieves the successful analysis attempt.
• GitHub has no atomic head-check-and-post operation. commit_id pins the review to the inspected SHA across that narrow race.
• Analysis outcome, pinned settings, usage/cost, and publication status are archived. A failed POST is recorded as unconfirmed because it may have reached GitHub; reruns check markers first.
• Cached input tokens are excluded from the uncached token cost to avoid double-counting usage.

Validation

• python3 -m unittest discover -s tests -v: 21 tests passed, including malformed/missing/incomplete JSON, wrong SHA, invalid paths/ranges, deleted and renamed lines, duplicate/retried publication, stale/closed/draft PRs, and read/write API failures.
• actionlint 1.7.7 and git diff --check: passed.
• Pinned action source confirms inline output-schema support; CLI 0.149.0 exec --help confirms the underlying flag without changing the runtime pin.
• Actual publisher read-only API wrapper successfully fetched existing GitHub review history.
• Local parallel finding reviews, independent verification, and a final fresh review completed before push.

[jitsu-code-review]

Review of a5e5364141f1527d9377f91a13078c6ae83efb44

Reviewed the complete diff and publisher validation flow; no high-confidence introduced defects found.