chore: strengthen Argus review checks

[bokelley]

Summary

Strengthens Argus and the shared code-reviewer role around three review misses from the A2A PR pass: lifecycle paths that only look wired, public dispatch keys that get silently mutated, and local workspace artifacts that should not ship.

Also moves expert delegation guidance above the live Argus prompt cut point so the GitHub Action actually receives it, and adds PR-template checklist items that give Argus structured signals for these cases.

Tracks / decisions touched

Argus/reviewer configuration only. No SDK runtime surface or ROADMAP decision changes.

Test plan

• node scripts/import-claude-agents.mjs
• git diff --check
• Verified the live ai-review.yml prompt extraction includes the new audits/delegation and excludes direct gh pr review instructions
• Prompt-engineer review run; material lifecycle-verification gap addressed
• Code-reviewer pass run; generated mirror concern checked directly
• ./gradlew build green (not run; prompt/template-only change)
• New tests added for new behavior (not applicable; prompt/template-only change)
• Public API surface change → changeset added (not applicable)
• Builder/transport/lifecycle/third-party SDK change → integration or manual smoke test proves the real composed path runs (not applicable)
• Invalid/overlong public names or IDs are rejected, not silently truncated or normalized server-side (not applicable)
• No workspace-local artifacts committed (.wt-claim, .wt-*, .context/, .local/, .DS_Store)

Note: this PR touches .github/ai-review/**, so Argus should pause via the self-modification gate and require human review.

[aao-ipr-bot]

🛑 Argus paused on this PR.

This PR modifies Argus's own configuration (.github/workflows/ai-review.yml or .github/ai-review/**). Argus will not post an approving review on changes to its own gates — a human reviewer must take this PR.

Workflow run

_{Automated by the Argus self-modification gate.}