Add durable review and fix loop

[hudsonaikins]

Summary

• add a Git-native compare-and-swap JSON ledger on refs/tabellio/reviews
• sync Forgejo reviews, inline comments, issue comments, and checks
• import provider-neutral Codex or other agent findings tied to exact head commits
• add deterministic triage, fix, draft, conflict, validation, and readiness states
• bind fixes to unique Entire checkpoints and remap commits across restacks
• add approval-gated git-spice restack operation discovered by live workflow testing

Validation

• npm run check (49 tests)
• normal and bare Git ledger tests
• live Forgejo PR Add OpenSSF Scorecard workflow #1: comment, triage, checkpoint fix, update_required, approved restack/update, sync, remap, ready
• live Forgejo PR Update Scorecard workflow action versions #2 terminal merged-cycle sync
• Entire checkpoint 61229f2bfcff bound to commit

Storage boundary

Review state uses standard Git objects and refs. Forgejo remains the visible review surface. Ledger ref publication is still a separate approved remote write.