fix(security): harden fork workflow-run context

[aheritier]

This seven-commit security remediation closes the fork workflow_run context-forgery path while preserving direct-review behavior.

• Removes the privileged fork-PR E2E bridge; credential-bearing E2E routes are trusted-only.
• Adds a trusted resolver that derives PR/comment context from live GitHub API data, rather than fork artifacts.
• Validates and binds an immutable 40-hex PR head SHA before review, checkout, and check-run use.
• Transports canonical context only through a same-run artifact selected by immutable artifact ID.
• Rebuilds feedback and mention routing from canonical live context, including correct threaded-reply routing.
• Adds regression/routing-matrix coverage and updates the trust-boundary documentation.

[Sayt-0]

The threat model is right and the design closes the fork workflow_run forgery path: server-derived context, actor binding, immutable 40-hex SHA, same-run artifact by ID. I traced the main attack chain and it's refuted — a non-member can't borrow a member's comment since comment.user.login must equal run.actor. Removing the privileged E2E bridge is a clear win.

Requesting changes on one blocker and two regressions:

• Blocker — findAssociatedPr() compares pr.base.repo.full_name, which GET /actions/runs/{id} never returns (pull-request-minimal → {id, name, url}). It therefore always throws when pull_requests is non-empty, i.e. for every same-repo PR. Forks still work via the pulls.list fallback, but this repo's own dogfooding and the documented 2-workflow pattern break 100% of the time once released. Repro inline. CI is green only because the unit fixture invents the field and the handwritten interfaces hide it from tsc.
• SHA race — the headSha !== runHeadSha hard failure turns an ordinary push into a review lost with no PR-visible signal, and the documented trigger has no synchronize to re-fire it.
• Lost inline context — CanonicalComment drops path/line/diff_hunk, so fork mentions render empty FILE_PATH=/LINE= and fork feedback records File: unknown (line ?). These come from the live comment, so restoring them costs nothing security-wise.

Smaller items inline: the routing-matrix test is tautological, SKILL.md's trigger template has no reviewer gate, AGENTS.md layout, migration/rollback ordering.

One option to land this fast: blocker + SHA race + a realistic fixture here, the rest as an immediate follow-up.

_{Checked: 978 unit tests / biome / tsc / actionlint all green (no coverage of the blocker); ~10 read-only gh api calls on live runs to establish the real pull_requests[] shape; standalone repro with only @octokit/rest stubbed.}

[Sayt-0]

While editing AGENTS.md: the "Repo layout" tree above lists every src/<name>/ helper, but src/resolve-trigger-context/ is missing (grep -c resolve-trigger-context AGENTS.md → 0). Worth adding an entry next to src/rate-limit/, in the same index.ts / <name>.ts / __tests__/ style.

Also, this paragraph plus the ones in SECURITY.md and review-pr/README.md restate the same 0700/0600 invariants three times in dense single blocks. One authoritative description with links from the other two would age better.

[aheritier]

Fixed in eca6cad: the missing resolve-trigger-context layout entry is now documented. Optional 0700/0600 documentation de-duplication is deferred; this thread is intentionally left unresolved.

[docker-agent]

Assessment: 🟢 APPROVE

This PR introduces a well-designed security overhaul replacing the insecure fork workflow pattern (raw artifact data passed into privileged jobs) with a server-side canonical trigger context resolver. The core security properties are structurally sound:

• Workflow run metadata is fetched live from the GitHub API (status, repo, SHA cross-checked)
• The canonical context is written to a mode-600 file in a private runner.temp directory
• Artifact transport uses immutable numeric artifact IDs, not mutable names
• Downstream jobs guard against symlinks and verify permissions before consuming context
• ${{ interpolation in run: bodies is eliminated; immutable resolved SHAs replace refs/pull/N/head checkouts

No high- or medium-severity bugs were found. Only low-severity observations remain (misleading error message when both GITHUB_APP_TOKEN and GITHUB_TOKEN are unset; redundant chmodSync after writeFileSync with the same mode; requireRunId accepting leading-zero strings — all harmless). The security model is correct and the PR is safe to merge.