[ajianaz]

Closes #647. Part 6/6. Stacked on #654 (#646) → #653 (#645) → #652 (#644) → #651 (#649) → #650 (#648): earlier commits here are those PRs; the diff shrinks as they merge.

What

• Four MCP tools with the agent as the judge, no LLM configured in cora: cora.review_prepare (hardened prompts, valid_files, deterministic findings, response schema), cora.review_finalize (merge + validate + rules + gate + verdict), cora.scan_prepare (paged by batch, path restricted to the project) and cora.scan_finalize. Stateless: finalize recomputes the deterministic half from the same diff/path, so there is no packet id to expire or poison.
• The agent's findings go through judge::admit (security(review): treat judge output as untrusted input; self-contained Packet; correct cache key #644): rule_id cleared, text and count bounded, files/lines outside the diff dropped. A new AgentJudge adapter plugs into the same review_with pipeline; no cache in agent mode.
• cora install also installs a /cora-review skill for Claude Code (~/.claude/skills/cora-review/SKILL.md; a customized copy is kept unless --force; --remove deletes it).
• Docs: docs/usage.md ("Review with your agent") incl. the security model; tool list in docs/configuration.md.

Also fixed (found by the end-to-end run)

cora.review_diff has always panicked in the real MCP server: "Cannot start a runtime from within a runtime" (confirmed on current develop), because handlers block on a second runtime from a #[tokio::main] runtime thread. All handlers now go through a block_on helper using block_in_place; its unit tests never hit that path, so there are regression tests that run on a multi-thread runtime.

Why

Asking users to configure an LLM first is too much friction. An agent can review with its own model; cora supplies the deterministic checks, the prompts, and the validation.

Testing

• cargo fmt --check, cargo clippy --all-targets --features tree-sitter -- -D warnings, cargo test --features tree-sitter (1187 passed; new: 13 agent-tool tests incl. hostile output, path escape, runtime-thread regression; 5 skill-install tests).
• End to end over real MCP stdio with an empty HOME and no API key, acting as the agent: prepare → finalize merged my finding, cleared a forged rule_id, dropped /etc/passwd, kept the deterministic findings; scan prepare/finalize worked; path: "/" refused.

Notes

• Agent results are advisory for developers; the hard CI gate should stay deterministic (--no-llm) or HTTP-LLM, especially for fork PRs.
• Pre-existing, unrelated: the Security Audit (CVE) job fails on every PR right now (RUSTSEC unmaintained unsafe-libyaml, yanked chacha20).