feat: PR Review 2.0 — faster, keyboard-first, AI-assisted (v3.6.0)

[devlint]

Rebuild of the in-app PR review around performance, review flow and a local-first AI layer — benchmark-driven, per roadmap.md v3.6.0.

Benchmark first

• Competitive study (GitKraken, Tower, Graphite, GitButler; Greptile v4, CodeRabbit, Copilot code review) + full audit of the current review surface → target-UX spec: docs/superpowers/specs/2026-07-09-v3.6.0-pr-review-2-target-ux.md
• Implementation plan (15 tasks, TDD): docs/superpowers/plans/2026-07-09-v3.6.0-pr-review-2.md

Performance rebuild

• Lazy per-file diff parsing — no more whole-PR synchronous parse on open (single fetch kept; per-file parse on selection, cached)
• Diff line virtualization via @tanstack/vue-virtual (shared useVirtualRows lifted from CommitLog), full-render fallback under 300 lines to preserve native find/select
• Hot-path detail revalidation slimmed from 6 calls to 3 (getCIChecks, gitFileCount, listIssueComments deferred per tab)
• headSha surfaced on PullRequestDetail across the 4 forges (cache keys + viewed invalidation)

Review flow — keyboard-first

• GitHub-standard keymap on the Diff tab, pure tested resolver: J/K hunks, ⇧J/⇧K files, V viewed, ⇧V hide viewed, T file filter, C comment, N/P AI findings, ⌘Enter submit
• Viewed-file state (client-persisted per PR, invalidated on re-push) + progress bar, optional viewedFiles on SubmitReviewOptions
• Pending review draft persisted across close/reopen + counter badge
• Dismiss review & request reviewers (GitHub real; capability-gated UI elsewhere — actions hidden, never silent no-ops)

AI pre-review (Greptile-style, local-first, opt-in)

• Background multi-hop pipeline on PR open: diff → import/dependency extraction (@gitwand/core) → blame/history of changed lines → line-anchored findings with confidence scores
• Signal over noise: user confidence threshold, top-N cap, per-repo dismissal memory (dismissed finding classes stay suppressed)
• Bounded, cancellable, visibility-gated execution; SWR-cached per repo#number@headSha — zero AI calls when disabled
• AI PR summary (what / why / affected areas) on the Info tab, regenerable, DOMPurify-sanitized
• Unified useReviewIntelligence pipeline: pre-review findings + static flags + CI annotations merged under one shared LineAnnotation model (source-discriminated: ci/ai/static), one settings surface ("Review AI"), AI output localized in all 5 product languages

Multi-forge

• GitLab review methods completed (largest stub gap): real submitReview with inline batch comments via discussions, real listReviews, properly anchored createComment, real getFileHistory, dedicated gl_mr_diff_refs command
• Azure comment edit/delete: honest capability gating (buttons hidden, no runtime throw)

Verification

• Adversarial verifier pass → 2 major + 2 minor findings, all fixed (GitLab dismiss gating, dismissal memory on cache hit, CHANGELOG wording, AI locale coverage) → final GO
• Tests: core 974 ✓ · desktop 583 ✓ (76 files) · cli 26 ✓ · mcp 12 ✓ · parity 10 ✓ · vue-tsc clean · pnpm -r run build clean
• dev:web parity: every new Tauri command ships its backend*.ts wrapper + dev-server.mjs route; i18n synced across en/fr/es/pt-BR/zh-CN; no version files touched

Known follow-up (documented in plan): hunk-critique anchoring not yet wired into the merged annotation stream (existing on-demand UX kept in parallel).