Add the acceptance review pilot (roadmap stage 04 first slice)

[ClaudiuSchuster]

What this changes

Roadmap stage 04 ("Acceptance & QA") first slice, additive like the stage 02/03 pilots:

• Migration 0006_milestone_reviews.sql — immutable review decisions binding one exact delivery revision (UNIQUE(milestone_id, delivery_revision, decision)), optional note (10–2000 chars).
• receipts.mjs — the v1 reviewer is the project coordinator (structurally never the delivering contributor, since the coordinator cannot hold the confirmed commitment):
  • revision_requested with a mandatory note naming what is missing — no status change, full trail;
  • accept binds exactly the newest immutable revision (409 stale_revision otherwise — matched bytes of a superseded revision are not a current delivery), completes the milestone like the existing complete action and leaves a delivery_accepted event;
  • defined outcomes everywhere: 409 duplicate_decision, 409 milestone_closed, 403 for non-coordinators, 404 for unknown revisions; expected_version compares against the milestone version.
• Public trail: GET/POST /api/v1/projects/{id}/milestones/{milestone_id}/reviews with reviewer attribution, and every delivery manifest now carries its own newest review decision (review field) — the decision trail travels with the receipt.
• Contracts: OpenAPI 1.4.0 (MilestoneReview, MilestoneReviewRequest, MilestoneReviewsPage — deliberately not ReviewsPage, which is the workshop reviews schema), check-agent-data route/scope/schema guards (87 rejection self-tests), llms.txt "Make acceptance explicit", roadmap + vision present stage 04 as first slice live with the remaining scope named (independent QA roles, conflicting approvals, dispute paths).
• Pins: 0006 hash in commons_artifact, SCHEMA_SHA256 = 3c9c5ec9… in all three places (rehearsal module, workflow YAML, docs), test counters (MIGRATIONS 6, blobs 15), participations migration list.

Verification

• reviews.test.mjs: full loop (deliver → revision request → new delivery → acceptance → milestone done → trail + manifest fields) and every guard; commons suite 89/89 in node:24.
• check-site, agent-data self-tests (87), UI suites 30/30 pass.

Deployment note

Commons change → full promotion chain after merge (D1 0006 first, then dispatch, then vars.STATIC_API_RELEASE_SHA, then publish — per docs/release-commons-artifacts.md).