feat(source-control): add the review_venue setting and blocking-only re-review #13136

Part of #7576 (PR 1 of 3).

Problem

Review venue is detected automatically per lane (plugins/source-control/skills/pull-request/reference/review-venue.md, scripts/review-venue.sh), but a repository cannot set it. #7576's Key interfaces and the owner's interview answers name one setting: "one review venue per PR via review_venue (auto, local, ci, both; default auto)" (Q500), with CI lanes as the default venue (Q605: "KEEP, with CI lanes as the venue.").

Done when

• docs/conventions/source-control.yaml, plugins/source-control/schemas/source-control.schema.json (which sets additionalProperties: false, line 7) and the source-control plugin.json userConfig declare review_venue with values auto, local, ci, both and default auto, repo scope, resolved like pr_open_state (repository value over userConfig).
• plugins/source-control/skills/pull-request/reference/review-venue.md reads the setting first: auto keeps today's per-lane read of review-venue.sh; local runs every local review step and skips the script; ci skips the local review steps whatever the script prints; both runs the local steps and still counts the CI lanes. Each value has its report line.
• A test beside scripts/review-venue.test.sh (or the setting reader's test) covers each of the four values and an unknown value, which falls back to auto with a notice.
• After the first whole review on a PR, the CI review lanes post only blocking findings (Q500: "blocking-only after the first review"). Main has this rule only past the round cap (plugins/review/skills/code-review/SKILL.md:249 and plugins/review/skills/security-review/SKILL.md:379, "When the prior-findings file says past the cap: yes"); move that trigger to "after the first whole review" in both skills and in whatever writes the marker (plugins/review/lib/prior-findings.mjs), rather than adding a second rule.
• Changelog fragments for source-control and review.

Filed by Issue Triage from the #7576 spec (agent choice, verified against main). This was generated by AI.