fix(review): read head check runs, name make verify unconditionally

[bketelsen]

Summary

A reviewer produced a false block on frostyard/core#118 round 2 because the minted pr-review instructions never told it to read the pull request head's check runs, and let it treat make verify as optional ("when it exists" / "where it exists") — a missing target is silently skipped instead of flagged.

This closes #248 by:

• src/queue/pull-request-review.ts: the pr-review root instructions now direct the reviewer to read the head's check runs first (gh pr checks / commits check-runs API) and treat their conclusions — not the PR description — as the evidence for CI-anchored acceptance criteria; make verify is now named unconditionally, its absence itself a blocker (defect:makefile:verify-missing). The pr-review-fix instructions get the same unconditional make verify and now ask the fixer to check the head's check runs after pushing.
• .agents/skills/review-snowcat-queue/SKILL.md: the "Judge" step gains the same read-the-check-runs rule and unconditional make verify; the "Finish" step's evidence bullet now requires the head SHA, each check run's name/conclusion, and the local make verify result.
• docs/specs/work-queue.md rule 53: the minted instructions MUST direct the reviewer to the head's check runs as CI evidence and MUST name make verify unconditionally (no "where it exists").
• test/pull-request-review.test.ts: extended the existing minted-instruction-text assertions to require check-runs/gh pr checks and the absence of "when it exists" / "where it exists", for both the pr-review and pr-review-fix roots.

Risk tier 2 (src/queue/** steers reviewer behavior but is not itself a governance boundary here).

Closes #248

Verification

• grep -c 'when it exists\|where it exists' src/queue/pull-request-review.ts .agents/skills/review-snowcat-queue/SKILL.md → 0 for both.
• npx tsx --test test/pull-request-review.test.ts → 19/19 pass, including the two new instruction-text assertions.
• npm run typecheck → clean.
• npm run test:coverage → 382/382 pass.
• npm run check:coverage-floors → check-coverage-floors: Node 24 per-file floor(s) met — src/control/store.ts lines 32.2%≥27% funcs 20.81%≥2%; src/queue/store.ts lines 57.31%≥52% funcs 22.5%≥16%
• npm run check:coverage-denominator → all 72 src modules present.
• npm run build → clean (check-dist, check-boot pass).
• npm run check:audit, npm run check:docs → clean.
• npm run check:deploy could not run: shellcheck is not installed in this sandbox and I have no permission to install packages (apt-get install fails with a dpkg lock permission error). This script is unrelated to the change (only lints deploy/**, which this PR does not touch); the check ran clean on the base commit's own CI, and CI here has shellcheck available.