fix(review): freeze composable review workflow state machine

[kamjcx]

Summary

• freeze the cfr-review-state/v1 human-review state machine
• make approve/reject decisions composable in either legal order by binding approvals to immutable trace prefixes
• add atomic idempotent retries, strict stale-revision CAS, single-winner approvals, and immutable single-lock behavior
• validate canonical candidate, approval, trace-envelope, event-semantic, catalog, registry, policy and evidence bindings at the store boundary
• add admin-only JSON review endpoints whose decision and lock actor identities come from verified authorization context
• preserve retrieval, ranking, factor values, candidate IDs, qualification, frozen answers, and the public resolve API

Final verification at 7e61782d95dfc5b5311f095ff925f9677f585de5

• Core: 586 passed, 86.91% branch coverage
• Review state machine: 14 passed
• Review + PR-A/PR-B focused regression: 94 passed
• Offline Harness: 13 passed, 43.35% branch coverage
• Evaluator critical path: 6 passed, 84.18% branch coverage
• Ruff, mypy, compileall, package build, archive isolation, and public delivery scan: PASS
• FactorBench V1/V2/V3, Frozen Unit, Sealed Unit v2/v4, Portfolio, Autonomous: PASS
• Exact-head GitHub checks: 8/8 PASS (two test, two container, two Python 3.12, two Python 3.13)
• Independent read-only QA: PASS, P0/P1/P2/P3 = 0/0/0/0

Stack

Base: PR #24 / codex/unit-field-contract-v1 at 24cf05884cc29358ceb57eeece42ed4585eb466a.

This PR is intentionally open and unmerged. PR #23 and PR #24 also remain open and unmerged. The reference review store is in-memory; durable deployment storage remains an adapter responsibility and is not claimed by this PR.