Adds a bonk-style generic engineering review that runs in the same
orchestrator run as the existing style-guide review and posts findings
in the same bot comment, now split into "### Code Review" and
"### Style Guide Review" sections.

- New code-review skill: reviews all changed files (including code
  examples in MDX) for bugs, error handling, security, dead code, and
  maintainability. No style/prose checks; defers CI-caught issues.
- New in-process fan-out (lib/code-review-inproc.ts) mirroring the
  style-guide one: per-file sessions, concurrency 5, cap 20 files.
- Code findings add a `critical` severity above warning/suggestion and
  use the CR- id namespace; reconcile skill preserves it.
- Code-review agent gets full-file context via GitHub-API-backed tools
  (read_repo_file defaults to the PR head SHA, search_repo).
- The repo root AGENTS.md is fetched at the head SHA and injected as
  agent instructions every run, since the Worker has no repo checkout
  to discover it from.
- Orchestrator runs both reviews concurrently (one failing degrades to
  empty rather than aborting), reconciles per stream, persists
  { code, style } findings to R2 (legacy bare-array tolerated), and
  renders one unified comment.

Cadence is unchanged: this rides the existing code-review-orchestrator
triggers (auto on PRs, /review, /full-review).

Fixes surfaced by the bot reviewing its own PR (#31562):

- getRepoFileContent: decode base64 as UTF-8 via TextDecoder (atob alone
  produced mojibake for non-ASCII content such as em dashes in AGENTS.md);
  URL-encode path segments; return null only on 404 and throw on other
  non-2xx so "absent" is distinct from "failed to load".
- Fetch the root AGENTS.md from the PR base ref instead of the head SHA.
  The content is injected into agent instructions, so reading it from the
  head let a PR poison AGENTS.md to inject instructions into the reviewer.
- Render: a degraded (failed) review section now shows a failure note
  instead of "No issues found", and the status line notes the partial
  failure; carried-forward findings still render. Orchestrator passes the
  per-stream failure flags into renderComment.
- Render: match acknowledged findings by stable id, not path:line:rule, so
  two findings sharing those fields are not both dropped.
- github-repo-tools.ts: update stale file header (now shared by the
  Dependabot and code-review agents).

…memory limit

The code-review specialist timed out on large PRs. AI Gateway showed all
model calls succeeding (0 failures) but slow (p90 ~47s, p99 ~103s), so the
cause was DO memory pressure plus total wall-clock, not model errors:

- A 13-file run at concurrency 5 hard-OOM'd the specialist isolate
  ("SQL query failed: ... memory limit") and never reached run_end.
- Even without OOM, 13 multi-turn file sessions exceeded the orchestrator's
  10-minute poll deadline.

Fixes:
- CODE_REVIEW_MAX_FILES 20 -> 10. Each code-review file is a multi-turn
  agent session, so this bounds both peak isolate memory and wall-clock.
  Covers virtually all docs PRs; larger PRs review their 10 largest files.
- Orchestrator specialist poll timeout 10m -> 20m, since a legitimate large
  review is many slow model calls and the specialist runs durably in its
  own DO.
- Concurrency stays at 3 (memory).

…d-mode commands

Routes code review to one of two strategies based on combined diff size:

Fan-out (≤50 KB): per-file sessions, concurrency 5, cap 20 files. Good for
smaller PRs; maximum per-file detail, parallel sessions, per-file degradation.

Holistic (>50 KB): single session over the entire PR diff in one pass, cap 50
files (lib/code-review-holistic.ts). Enables cross-file reasoning, no per-file
setup overhead, faster and more reliable on large PRs where fan-out wedges.
New code-review-holistic skill: rich substance from the per-file skill, reframed
for whole-PR review, model-owned navigation.

Comment heading reflects which ran: 'Holistic Code Review' or
'Fan Out Code Review'. Both paths log inputTokens/totalTokens for calibration.

Two new codeowner slash commands:
  /fan-out-review  — forces fan-out regardless of diff size (with warning in
                     the comment that it may be slow/fail on large PRs)
  /holistic-review — forces holistic regardless of diff size

forceReviewMode threads through orchestrate → orchestrator → review-specialist
→ code-review-specialist, overriding size-based routing when set.

Also: selectCodeReviewFiles takes an optional maxFiles param (holistic passes
50, fan-out uses the existing 20 default); per-file usage logging (inputTokens,
totalTokens) added to reviewSingleFile; progress logs committed from the
previous session also included here.

…; fix partial run consuming auto-review slot

/fan-out-review and /holistic-review now check getPullRequest().user.login
for dependabot[bot] before dispatching, matching the /review and /full-review
pattern. Dependabot PRs route to /workflows/dependabot-review without
forceReviewMode; regular PRs keep the forced mode.

markAutoReviewCompleted now only fires when both codeOutcome.ok and
styleOutcome.ok are true. Previously a partial run (one specialist degraded)
still consumed an auto-review slot, which blocked the retry the comment
promised would happen on the next push.

The placeholder writes added in the previous commit caused a race: both
specialists write their degraded placeholders within ~1-2s, the first to
write checks the sibling's placeholder (which looks like a valid result),
claims the lock, and finalize fires immediately with two ok:false results
before either review ran — posting an instant failure comment.

Fix:
- Add final:boolean to StreamResultPayload (false=placeholder, true=real)
- tryClaimFinalize now checks final:true on the sibling — a placeholder
  (final:false) is not treated as 'done', preventing premature triggering
- Orchestrator writes both crash-protection placeholders (final:false)
  BEFORE admitting specialists so a key exists even if a specialist DO
  is evicted immediately after admission
- Specialists write final:true in their rendezvous tail (removed the
  redundant per-specialist placeholder writes added previously)

…refactors

A. Robustness (stuck-review fixes):
- Wrap all specialist setup (token, diff fetch) + review in one try/catch;
  any setup failure now writes a final:true degraded result and triggers
  finalize rather than throwing and leaving the placeholder stuck at final:false.
  Extract shared reportSpecialistResult() helper into lib/finalize-rendezvous.ts
  to eliminate the duplicated rendezvous tail across both specialists.
- Orchestrator admit failures overwrite the placeholder with final:true degraded;
  if both fail, orchestrator itself claims the finalize lock and admits finalize.
  Drop redundant type casts on the narrowed admit union.
- finalize-review post-comment failure now returns {finalized:false} and skips
  markAutoReviewCompleted and cleanupPending so the next push can retry without
  burning an auto-review slot on an undelivered comment.
- Degraded streams (ok:false) skip reconciliation and carry previous findings
  forward as active, preventing false resolution of prior issues.

B. Defensive R2 / JSON:
- Wrap obj.json() in try/catch in readContext, readStreamResult, and
  tryClaimFinalize; treat corrupted/partial writes as null/not-final.

C. Safety:
- Guard req in orchestrator with an explicit throw instead of req!.
- safeOrigin() helper returns '' on URL parse failure in both specialists.
- parseReviewSpecialistPayload validates pr field shapes and DiffMode union
  (incremental requires fromSha+toSha strings); normalizes baseUrl to a
  valid absolute http(s) origin via new URL().origin, dropping invalid values.

D. Correctness:
- Holistic reviewedFiles now built from patched files only, matching the diff
  actually sent to the model.
- clearTimeout called immediately after await handle resolves in both holistic
  and per-file reviewSingleFile, preventing a late timer from mislabeling a
  post-resolve error as a timeout.
- Finding ID hash widened from 6 to 12 hex chars (24→48 bit) in both CR-/SG-
  namespaces; line number deliberately kept excluded for cross-commit stability.
- withConcurrency clamps limit to Math.max(1, Math.floor(limit)).

E. Dev script (bin/clear-r2-pr-data.ts):
- WHERE clause tightened to 'diffs/pr-%' and 'inflight/pr-%' (was 'diffs/%').
- Switch execSync string interpolation to execFileSync with argument arrays.
- Freshen stale header comment.

F. Refactors:
- Collapse four near-identical /review /full-review /fan-out-review
  /holistic-review handlers in orchestrate.ts into one shared helper.
- Merge duplicate cloudflare-shell imports in style-guide-specialist.ts.

G. Docs:
- AGENTS.md: add finalize-review row to workflow table; rewrite request flow
  to describe dispatch-only orchestrator, R2 rendezvous, final:bool flag, and
  finalize-review steps; add v6 migration; update slash-command list.

…th spiral

The FlueCodeReviewSpecialistWorkflow and FlueStyleGuideSpecialistWorkflow
DOs accumulated SQLite state from previous crashed runs. Each OOM leaves
orphaned session data in the DO's storage. After several crashes the
accumulated state is large enough that even the Flue alarm recovery handler
OOMs on startup (~900ms, repeating every ~30-60s), creating a death spiral
where no future review can complete.

Fix: two-step migration to reset the storage:
  v7 — rename bloated instances to *Old (abandons their storage)
  v8 — recreate the classes with empty storage under the original names

The wrangler bindings still point to the original names (FlueCodeReview-
SpecialistWorkflow / FlueStyleGuideSpecialistWorkflow), so no code changes
are needed. Run history prior to v7 is lost.

Holistic mode timed out on large PRs (>50 KB diff, single model pass,
15-min hard timeout) producing zero findings. Fan-out is strictly better:
bounded per-file sessions, graceful per-file degradation, guaranteed
completion on any diff size.

- Delete lib/code-review-holistic.ts and .agents/skills/code-review-holistic/
- code-review-specialist.ts: always fan-out; remove routing logic, holistic
  imports, env reads, forceReviewMode handling
- lib/code-review-inproc.ts: remove CODE_REVIEW_HOLISTIC_* constants and
  re-export; remove reviewMode from both return sites
- lib/code-review-results.ts: remove reviewMode field from CodeReviewResult
- lib/review-specialist.ts: remove forceReviewMode from payload type + parser
- code-review-orchestrator.ts: remove forceReviewMode from payload + specialistBody
- orchestrate.ts: remove /fan-out-review and /holistic-review commands
- code-review-render.ts: heading always 'Code Review'; remove codeMode from
  RenderReviewInput; remove /fan-out-review and /holistic-review command rows
- finalize-review.ts: remove codeMode from renderComment call
- AGENTS.md: remove holistic routing description and command bullets

Replace rigid format rules (title must start with [Product] or type:,
description must have a ### Summary section) with lenient semantic checks:

1. Product/area identified — title OR description names the area; no tag required
2. Description explains the work — any human prose passes; only flag truly empty/placeholder descriptions
3. Scope accuracy — only flag material misrepresentation, not missing details

Default to no finding in all three. Only flag clear, significant violations.