Implement eval follow-ups from the #1140 run

[jirispilka]

Closes #20. Five guardrails, each pinned by a contract test citing the run's measured cost:

• Decay rule: a round whose open findings are all doc/comment-only is proposed as pr-note instead of another fix round (iters 5-9 burned ~1.2M tokens polishing comments and introducing new wrong ones). Replaces the step-7 light re-review path, now deleted.
• Reviewer Questions: entries route to the implementer only to verify (recorded in iter-N/question-verification.md), never as fixes to apply (~500k tokens on a built-then-reverted suggestion).
• followups reads the repo's open issues and PRs so dispositions cite existing issues instead of guessing or duplicating.
• Dispatch start times land in _progress.md; status unknown reports state time since dispatch (a dead implementer surfaced ~9h late).
• New files enter diff.patch via git diff --no-index /dev/null ; git diff is silent for untracked paths.