feat(pipeline): mirror dispatcher into code-review.md + migrate 10 more agents

[bborbe]

Summary

Completes the dispatcher refactor follow-ups noted in PR #27.

What's in this PR

commands/code-review.md — Step 4 now mirrors commands/pr-review.md's dispatcher shape (PR #27): 4a ast-grep-runner mechanical funnel; 4b per-Owner concurrent adjudication; 4c context-specific convention reads; 4d citation validation. Conditional / full-mode agents that don't yet have RULE blocks (license, readme-quality, shellcheck, context7, go-version-manager, go-tooling) continue on the legacy direct-invoke path until their conventions land as canonical rules.

10 per-language agents migrated to the dispatcher contract:

• `go-quality-assistant`
• `go-architecture-assistant`
• `go-factory-pattern-assistant`
• `go-http-handler-assistant`
• `go-metrics-assistant`
• `go-security-specialist` (preserves toolchain fallback for findings outside the rule-base scope — gosec / trivy / osv-scanner still run)
• `go-test-quality-assistant`
• `godoc-assistant`
• `python-architecture-assistant`
• `python-quality-assistant`

Each gets: "When invoked by the dispatcher" section + Source of truth pointer to `rules/index.json` + citation discipline note (every emitted `rule_id` MUST exist in `rules/index.json`).

Total agents on dispatcher contract: 13 (3 from PR #27 + 10 here). The remaining 18 agents are utility / auditor / file-existence-check agents that don't enforce `rules/index.json` owners — they don't need dispatcher contract migration.

Legacy mode preserved on every migrated agent — they tolerate both shapes during rollout.

Test plan

• `make precommit` clean (links + JSON + check-index + check-coverage)
• `check-coverage: OK (124 rules, 15 mechanical YAMLs, no drift)`
• Migrated agents still readable as standalone (Source-of-truth + dispatcher invocation note added without removing existing role/constraints/process content)

[ben-s-pull-request-reviewer]

{
  "verdict": "approve",
  "summary": "PR #28 migrates 10 agents to the dispatcher contract and mirrors the dispatcher pipeline from pr-review.md into code-review.md. The diff is clean — only markdown files changed (agent definitions + one command). No Go/Python source code was modified, so no mechanical rule findings or security concerns apply. The dispatcher shape is consistent with pr-review.md Step 4; citation discipline language is added to all migrated agents; legacy mode is preserved where needed. One minor doc-path discrepancy in Step 4c (uses ~/Documents/workspaces/coding/docs/ instead of the /home/node/.claude/plugins/... path documented in pr-review.md for YOLO containers), but this only affects manual convention loading and does not affect the mechanical pipeline.",
  "comments": [
    {
      "file": "commands/code-review.md",
      "line": 113,
      "severity": "minor",
      "message": "Step 4c context-specific conventions table references path ~/Documents/workspaces/coding/docs/ which does not match the YOLO-container mount path /home/node/.claude/plugins/marketplaces/coding/docs/ documented in pr-review.md Step 4c. This only affects manual doc loading when diff touches .env, k8s, or teamvault files — not the mechanical pipeline. Consider aligning the path reference."
    }
  ],
  "concerns_addressed": [
    "correctness: dispatcher shape change in Step 4 — verified complete mirror of pr-review.md with 4a/4b/4c/4d structure plus conditional/full-mode agents",
    "correctness: go-security-specialist.md migrated with toolchain fallback preserved — citation discipline added for rule-base findings, toolchain findings exempt",
    "correctness: all 10 agents now have 'When invoked by the dispatcher' section — citation discipline enforced (rule_id must exist in rules/index.json)",
    "correctness: legacy mode preserved in go-factory-pattern-assistant, go-http-handler-assistant, go-security-specialist, go-test-quality-assistant, godoc-assistant — both shapes work without conflict",
    "tests: code-review.md no longer contains inline test-agent list — dispatcher handles agent selection; coverage adequacy validated by existing rule-base",
    "security: go-security-specialist migrated with toolchain fallback — security toolchain (gosec/trivy/osv-scanner) runs outside rule-base scope",
    "correctness: godoc-assistant migrated — exported-item documentation review still owned by godoc-assistant under dispatcher contract",
    "correctness: python-architecture-assistant migrated — Python-specific concerns still addressed under dispatcher contract"
  ]
}