feat(review): add bounded adaptive review delegation - #1770

Summary

• Keep one primary Review and add bounded additional review work only for concrete unresolved questions with independent value.
• Select concise review capabilities from the built-in worker, compatible code-review Skills, and configured read-only review agents; load full guidance only after the work is admitted.
• Bind each additional check to a typed question, immutable target fingerprint, assigned changed paths, expected evidence, and capability fingerprint.
• Present one Review result: clear additional-check progress, sanitized failures, localized report sources, and no Skill or agent identity leakage.

Bounded behavior

The Review parallelism setting allows serial or two-way execution. It changes concurrency, not review scope or the amount of work admitted.

Safety and compatibility

• Reject duplicate question-and-scope work and enforce shared worker and validation budgets in the runtime.
• Restrict GetFileDiff, Read, and Grep to the assigned target identity; fail closed for path escape, case aliases, alternate data streams, device paths, symlink aliases, and hard-link aliases.
• Include selected guidance and explicit model preference in the capability fingerprint; source-qualified custom-agent lookup avoids same-name collisions.
• Keep historical manifests and managed packet recovery compatible. Adaptive additional checks remain unavailable in remote workspaces, while existing managed remote compatibility is unchanged.

Product and documentation

• Keep Review as the primary user action and result; use Additional check / 补充检查 only when an individual supporting task must be identified.
• Replace fixed reviewer-roster and fixed-dimension language with problem-driven review behavior.
• Remove internal call limits, token budgets, and source identities from consent, task cards, reports, and Markdown exports.
• Use count-safe, localized reliability messages in English, Simplified Chinese, and Traditional Chinese.
• Update the Review architecture, lifecycle, and SDLC requirements to describe the implemented boundaries and compatibility behavior.

This change does not add a Review-specific telemetry service, cache, scheduler, Harness, or second runtime. Existing logs remain the diagnostic surface; no numerical latency or token reduction is claimed without production measurements.

Verification

• cargo check --workspace
• cargo test -p bitfun-agent-runtime deep_review --lib (128 passed)
• cargo test -p bitfun-agent-runtime deep_review::team_definition::tests --lib (3 passed on the rebased head)
• cargo test -p bitfun-core agentic::tools::implementations::task::tests --lib (70 passed)
• cargo test -p bitfun-core agentic::deep_review --lib (9 passed)
• cargo test -p tool-runtime grep_search --lib (6 passed)
• Targeted Web UI suite (9 files, 142 passed on the rebased head)
• pnpm run type-check:web
• pnpm run i18n:audit (0 warnings on the rebased head)
• pnpm run check:repo-hygiene
• node scripts/check-core-boundaries.mjs
• git diff --check

Independent final reviews covered architecture and scope, correctness and security boundaries, and product and i18n behavior. The only product P2 found was the English count grammar; it is fixed and the re-review found no remaining P0-P2 issues.