fix: gate PR review writes behind explicit authorization

[kosako]

Summary

• add explicit write-authorized / draft / read-only modes to personal-review-request
• require safe-gh trust classification before routing and untrusted diff reads
• keep draft mode metadata-only until fresh explicit confirmation; do not inherit standing authorization
• separate code-review must 0 from overall PR merge readiness
• add regression evals for authorization, safe-read order, standing consent, and verdict wording

Why

A natural-language review request must not silently authorize public GitHub comments or even raw diff collection before confirmation, and a clean code-review finding set must not be presented as proof that the whole PR is merge-ready.

Closes #212

Independent review

• Routing preflight: both commits are authored by Codex, so the required reviewer is Claude.
• Initial Fable review (17750ee..3f68e42): must 0 / should 3 / nit 2, verdict WARNING.
• Fix commit: ba0f653.
• Final cumulative Fable re-review (17750ee..ba0f653): all five prior findings RESOLVED; must 0 / should 0 / nit 2, verdict APPROVE.
• Remaining nits are optional mode-precedence wording and an additional successful draft→write eval.

Validation

• all 17 scripts/tests/*.sh self-tests
• scripts/check-manifests.sh — 21 manifests passed
• scripts/check-injection.sh — only expected pre-existing medium/low findings; no new finding
• scripts/build.sh — 42 assets passed
• scripts/register.sh — 42/42 registered, pending 0
• staged public-safety check passed