Fix reviewer provider/model merge gate

[andrei-hasna]

Why

OPE2-00289 identified a merge-gate integrity defect: reviewer artifact text could claim the workflow-required provider/model even when the actual reviewer run used another runtime. Three payroll-adjacent merges accepted OpenAI gpt-5.6-sol review runs while the workflows required Fable.

What changed

• Require the workflow to supply the reviewer provider and model; the merge skill does not hardcode Fable.
• Bind each reviewer artifact to reviewed base, exact head, merge-result tree, receipt ID, run ID, thread claim, timestamp, verdict, and remediation cycle.
• Resolve reviewer_run_id through package-owned codewith agent read <run-id> --json.
• Fail closed unless the authoritative run is present, completed, and reports matching run/thread identity, model attestation identity, applied provider, and bound runtime model.
• Treat artifact-authored provenance fields as claims to compare, never runtime authority.
• Preserve the existing one-reviewer rule and remediation cycles 0..2.

Exact candidate

• Task: OPE2-00289 / 250dd416-e5c3-4001-ab95-d27bb7acd653
• Base: 905826510829d1456423f45fc67d329cae3dd33c
• Head: c664480843da51bd751516f99273d7ebb8f76f45

Regression coverage

RED before the repair:

• Ran 30 tests ... FAILED (failures=10) for forged, missing, failed, nonterminal, and mismatched authoritative run cases.
• The executor forgery fixture did not report authoritative provider/model mismatch.

GREEN after the repair:

• Ran 37 tests in 12.434s
• OK
• python3 -m py_compile ... exit 0
• git diff --check exit 0
• staged gitleaks: no leaks found

Fixtures cover:

• required Fable plus OpenAI reviewer rejected;
• required Fable plus Fable reviewer accepted;
• unavailable required provider refuses substitution;
• forged artifact claims rejected by authoritative readback;
• missing run, failed read, missing attestation, nonterminal run, run-id mismatch, thread mismatch, applied-provider mismatch, and bound-model mismatch rejected;
• stale head and moved-base/merge-tree changes rejected;
• one reviewer and remediation cycles 0..2 preserved.

Rollback

Revert commit c664480843da51bd751516f99273d7ebb8f76f45. No migration, release, install, deployment, or production data change is involved.

Review boundary

This PR is intentionally draft. Independent Fable review of the exact candidate remains coordinator-owned. This implementation lane did not merge, publish, tag, install, deploy, change auth profiles, or retry payroll/Files workflows.