refactor(review): keep standard review single-agent

[limityan]

Summary

This PR simplifies the Review execution model around an explicit product boundary:

• Standard Review always launches one read-only CodeReview agent.
• Strict Review remains an explicit opt-in through /review strict, the historical /DeepReview compatibility alias, or a strict fix follow-up.
• Automatic risk scoring, L2 escalation, and the extra desktop decision round are removed.
• Strict Review still binds to the deep L3 strategy, includes the quality gate, and retains runtime manifest invariant validation.
• Unused composable-review contracts and an unconnected subject-candidate parser are removed rather than carried as speculative foundations.
• Existing Review architecture and SDLC workflow documents are reduced to the behavior that is implemented today; no new document is added.

Why

The previous adaptive path could turn an ordinary review into a multi-agent workflow based on fixed size and risk heuristics. That increased latency, model rounds, token consumption, and behavioral complexity while constraining work that a capable review model can perform directly.

The simplified boundary keeps evidence preparation and read-only safety deterministic, but delegates review depth and investigation to the review model. Multi-agent orchestration remains available only when strict intent is explicit. Team policy may recommend strict review but does not silently start it.

The removed composition and subject-candidate layers had no production consumers. The active slash-command, Git-range, workspace, and provider pull-request target paths remain on their existing parser and target-evidence flows.

Behavior and compatibility

• Review target resolution and bounded evidence checks remain unchanged for workspace changes, file scopes, Git ranges, and provider pull requests.
• Standard Review continues to use the prepared target evidence and exact-diff tools without write or subagent-launch capabilities.
• Strict Review continues to require launch confirmation and uses the existing DeepReview execution, queue, report, resume, and remediation boundaries.
• Existing persisted manifests remain readable. Older L2 metadata is still accepted by the runtime validator, and legacy manifests without a quality marker keep their compatibility path.
• The strict confirmation accurately presents scope, planned reviewers/calls, runtime tendency, and the read-only boundary. It does not claim token estimates, pre-launch range editing, or stop controls that are not implemented.
• No Agent loop behavior, lock policy, concurrency control, proxy handling, or ReviewFixer behavior is changed.

Verification

• Web type check passed.
• 110 focused slash-command, URL/target-resolution, Review, and DeepReview frontend tests passed.
• Product-domain tests passed with no default features and with product-full features after removing the unused contract.
• cargo check --workspace passed with existing warnings.
• Tracked repository hygiene and diff checks passed.
• Independent adversarial reviews of product behavior, architecture/documentation consistency, dead-code reachability, and token/performance reported no remaining Critical or Important findings.

Known baseline

The untracked local review artifacts are intentionally excluded from this PR. They can cause the repository hygiene script to report local absolute paths when scanned directly; the tracked-only PR content passes the hygiene check.