feat: persist structured review findings - #204

Review: approved ✅

The design decision I want to endorse explicitly: SubmitReviewFinding is read-only and there is no direct write endpoint. Applying a finding goes through an ordinary canonical turn, so it inherits Edit/Write permissions, approval, hooks, sandbox, cancellation, and snapshots.

A "just apply this suggested replacement" endpoint would have been the natural shortcut and would have punched a hole straight through #181's central gate — a tool-authored payload writing to disk without passing the dispatcher. Routing Apply through a normal turn instead means review findings get no privilege the model doesn't already have. That's the right call even though it costs a round trip.

What I checked

• Input validation rejects absolute paths, traversal, control characters, invalid ranges, and oversized replacements. Path traversal is the obvious one; rejecting control characters also matters because findings are rendered into terminals and webviews where escape sequences are actionable.
• Workspace-relative paths with a tight line range keep findings anchored and bounded.
• Successful results project into durable review_finding completed items, consistent with feat: define experimental runtime protocol #186's persist-completed-items rule, so findings survive resume.
• Malformed external finding payloads are rejected — findings can arrive from a client, so the server can't assume its own tool produced them.
• Shared reviewApplyPrompt means the three clients issue the same apply semantics rather than each phrasing it differently.

Validation: CI green; full suite green locally at the stack tip.