feat: verification probes with CI-aware execution policy

[eliahilse]

Reviewers can now execute, without duplicating CI.

• Probes allowed: engines may run small targeted checks — bun -e / node -e snippets, exercising a single function against an edge case, git inspection — to verify a suspicion before reporting it.
• CI-covered commands off-limits: kyora-review parses .github/workflows/* for run: commands, classifies suites/builds/linters/type-checks, and injects them into every engine prompt as banned ("if a finding depends on their outcome, state the expectation instead"). Re-running what the runner already runs is pure compute waste.
• Enforcement where the CLI supports it: claude/kimi get Bash allowed with deny rules (test runners, bun run/npm run scripts, tsc, turbo, installs, rm/mv, git push/commit/checkout/reset); codex keeps its read-only sandbox which already permits execution without writes; grok/qwen get the policy via prompt.
• 3 new unit tests for workflow parsing/classification (19 total).

Also restores the TOC README from #2 — it was stranded on feat/review-framework because #1 squash-merged to main before #2's merge landed on the branch, so main still had the old short README.

Includes #4 (branched from it) — merge #4 first and this diff collapses to the execution-policy changes.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CQy3ZJ5MyUxo4qjZwA93Na

[eliahilse]

Added a sixth engine while this was open: glm — GLM-5.2 on the Z.ai Coding Plan. Driven through Claude Code against Z.ai's Anthropic-compatible endpoint rather than opencode: opencode's Z.ai provider currently deadlocks on GLM's streamed tool-call deltas (anomalyco/opencode#6708 / #8428 — reproduced locally, hangs on any prompt that triggers tool use). Validated end-to-end against the live endpoint with a planted-bug test. Key resolves from ZAI_API_KEY or opencode's auth store, so an existing opencode auth login just works.

[eliahilse]

Seventh engine slot filled while open: qwen now runs qwen3.8-max-preview (Alibaba Token Plan) through Claude Code against the Token Plan's Anthropic-compatible endpoint — validated live with the planted-bug test (found it, critical, correct NaN analysis). Replaces the unvalidated qwen-code CLI adapter. Key resolves from QWEN_API_KEY or the opencode config that bl config agent writes. opencode itself is benched as a harness for now: fresh-state runs wedge on any tool-triggering prompt across three different providers (Z.ai, opencode-go, bailian) on this machine.