fix(review): resolve model words and linked roots and format final answers

[ZeroPoint95]

• Fixed explicit --light model words to resolve through the same profile catalog as --model; unknown words are refused before calls start.
• Fixed read-only sessions in linked checkouts to accept both owned root spellings while preserving external-path and symlink refusals.
• Added native formatting for final review answers only where the cached catalog publishes support, with one explicit unsupported-format fallback and unchanged local schema validation.
• Fixed the macOS updater regression to compare the exact physical installation path; updated manuals and added routing, containment, formatting, refusal and deadline regressions.
• Validation passed: make build, BASE=3950174ddfd8070786996003db4113732527fa95 make pr-ready, affected packages, focused race checks and independent review on 15640495a1c8305e74475a759d8f03208a1a570d.

Live acceptance remains incomplete: the latest unchanged-model OpenRouter review failed four of six agent sessions at their original 45-second limits and returned no assembled review. Structural analysis and the systemic lens completed; no model-ID, tool-path, format-rejection or raw tool-markup errors were observed. The run ended in 185.8 seconds within the original 300-second/$0.25 bounds. Models, reasoning effort and limits were unchanged; nothing was posted.