qa-review: tune the review job, and record that it is on hold (with why and how to resume)

[lihsaa591]

Summary

Merges the tuning of the manual-only QA review job and a CHANGELOG entry recording the decision to put it ON HOLD. Nothing triggers it automatically (no n8n flow, no webhook).

Tuning (verified on real public PRs #1428, #1393, #1392 of themegrill/user-registration, dry runs only):

• findings capped by change size in code; tighter prompt
• strict structured output (fixes the model dropping the test title key; optional 4th param on chatJSONWithUsage, existing Crisp/wp.org callers unchanged)
• no "none found" when risks were raised but failed verification; discard reasons logged for public repos only
• allowlist: themegrill/user-registration (public)

Hold decision: the reviewer never runs the plugin and overlaps Copilot / security-review / PHPCS; claudegrill already covers deterministic e2e and its agent tier is Claude-based and deliberately off. CHANGELOG has the reasons and a concrete resume path (local spike first, private repo for any agent run because this repo is public).

Testing

• npm test: 57/57.
• Live runs from this branch on #1428, #1393, #1392 (about 11 runs of the latter).

Not changed / known

• Test-title matching is still exact (case-sensitive); a near-miss like different capitalization is discarded. Left for if this resumes.