Add typed PR risk review and reusable GitHub Action

[forhappy]

Summary

• add the strict compass.pr_intelligence.report/1 domain model, canonical fingerprints, completeness, advisory rubric, and deterministic gate results
• freeze exact local or GitHub PR revisions, reuse immutable history and semantic diff evidence, and expose one review operation through CLI and MCP
• add deterministic JSON, text, Markdown, and SARIF projections
• add a checksum-verified reusable GitHub Action with safe fork handling, bounded sticky-comment delivery, artifacts, summaries, and fail-on: none|deterministic
• document the public contract, security boundary, commands, outputs, and CI usage

Impact

This adds compass review, MCP review_pull_request, and the root reusable Action. Advisory risk remains non-blocking; only typed deterministic gate failures can drive Action policy.

Validation

Passed locally:

• cargo fmt --all -- --check
• offline locked Cargo metadata resolution
• 10 local mock GitHub/Action tests
• Action YAML and JavaScript/shell syntax checks
• scripts/check_product_boundary.sh
• git diff --check

The required macOS Cargo target is on /Volumes/Workspace/crabbuild-target/compass-pr214. macOS currently stalls external-volume build helpers at _dyld_start, so Rust test/Clippy compilation is intentionally delegated to this draft PR's clean GitHub CI and remains a merge blocker until green.