[ajianaz]

Closes #644. Part 3/6. Stacked on #651 (#649), which is stacked on #650 (#648): earlier commits here are those PRs; the diff shrinks as they merge.

What

• judge::Packet now carries the finished prompts (llm::ReviewPrompts: hardened system prompt + user prompt with the fenced diff), so a judge that is not the HTTP LLM gets the same defenses.
• judge::admit(issues, valid_files, source): the one gate for any judge's output. Clears rule_id/also_matches, truncates text (title 300, body/fix 8000 chars), caps at 200 findings (most severe kept), drops files outside the diff/batch, and turns a line the diff/file does not contain into a file-level finding. Applied in review_with and in cora scan per batch. Deterministic findings merge after, so a judge can add but never remove.
• Cache moved behind HttpJudge: stores the raw model answer keyed by the exact prompts + model/provider/base_url/temperature.
• cora scan wraps each batch in an untrusted-data fence (same as review).

Why

Defenses against prompt injection only existed inside the HTTP path, and anything a model returned flowed to formatters, SARIF upload and history unchecked: a forged rule_id feeds suppression and the deterministic cap. The old cache key (diff + model + provider + base_url + temperature) ignored focus, rules, profile, sanitize, ignore.rules, hook.min_severity and could serve a stale or other-mode result.

Testing

• cargo fmt --check, cargo clippy --all-targets --features tree-sitter -- -D warnings, cargo test --features tree-sitter (1156 passed; new: 9 admit tests, hostile-output pipeline test, cache-key tests, scan fence tests).
• Manual with a real LLM: miss, then hit (returning cached judge response), then add ignore.rules and confirm the finding disappears on a cache hit.
• Not covered: sanitizer for scan (opt-in sanitize_comments stays review-only).