fix: review hardening — full push-range diff, fail-closed diff fetch, crash-safe queue, 403 self-heal

- push reviews now fetch ONE compare diff (before...after) instead of
  slicing to the first 20 commits under a head-sha status; new-branch
  pushes (zero before-sha) fall back to the head commit diff
- truncated diffs can no longer yield a clean pass: verdict capped at
  warn and status description prefixed 'partial review (diff truncated)'
- any diff-fetch failure (throw / empty body on a non-empty push or PR)
  short-circuits to status 'warning' ('review unavailable — diff fetch
  failed (not blocking)') with a ledger row; a diffless prompt is never
  sent to the model
- accepted jobs persist to sqlite (queue_jobs) before the pending status
  posts; startup re-enqueues rows that never reached a final state, so
  restarts no longer strand shas at 'pending'
- 403 on status/comment posts self-heals: admin-scoped token (config
  admin_token) adds shre-reviewer as collaborator (write), retries once
- scripts/wire-repos.mjs: idempotent estate-wide webhook + collaborator
  wiring over GET /repos/search
- tests: 32 -> 51 (truncation cap, persisted-queue reconciliation,
  collab-retry stubs, fetchDiff routing)

Co-Authored-By: Claude Fable 5 <[email protected]>

test/verdict.test.js

@@ -78,3 +78,30 @@ test('normalizeReview tolerates junk', () => {
   assert.equal(r.verdict, 'pass');
   assert.equal(r.findings.length, 0);
 });
+
+// --- applyTruncationCap ---
+import { applyTruncationCap } from '../src/lib/verdict.js';
+
+test('truncation caps pass at warn', () => {
+  const r = { verdict: 'pass' };
+  applyTruncationCap(r, true);
+  assert.equal(r.verdict, 'warn');
+});
+
+test('truncation leaves warn as warn', () => {
+  const r = { verdict: 'warn' };
+  applyTruncationCap(r, true);
+  assert.equal(r.verdict, 'warn');
+});
+
+test('truncation does not downgrade fail', () => {
+  const r = { verdict: 'fail' };
+  applyTruncationCap(r, true);
+  assert.equal(r.verdict, 'fail');
+});
+
+test('no truncation leaves pass untouched', () => {
+  const r = { verdict: 'pass' };
+  applyTruncationCap(r, false);
+  assert.equal(r.verdict, 'pass');
+});