Move release security reviews into Factory

[matthewp]

Changes

• Routes same-repository Astro release and smoke-test PRs through a dedicated durable coordinator and Workflow, including current-head validation, supersession, watchdog recovery, and managed check rerequests.
• Runs the reviewer against a credential-free, read-only CodeMode workspace with package baselines and published advisories, stores detailed reports privately, and publishes only fail-closed checks and sanitized comments.
• Adds the required Worker bindings, migrations, sandbox capacity, and an active code-quality workflow.

Testing

• Adds focused coverage for routing, contracts, checks, sanitized output, private report storage, sandbox staging limits, and package baselines.
• Adds coordinator regressions for stale deliveries, explicit rerequests, stop retries, pending preservation, supersession ordering, and watchdog timeouts.

Docs

• Updates the README with release-security behavior, GitHub App permissions, R2 setup, smoke validation, and cutover instructions.

Closes #13