Shared code review contract

Defines evidence, finding quality, verification gaps, and the boundary between review and remediation.

General and phased review use this common contract after their scope is selected. Confirmed findings can lead into already-authorized fixes while the review stage itself remains read-only.