cli+contract: check a review's text before sending, and reviewer role rules

tsk-g9kybnt9kf6b review Maity Coder Claude 006 (maity-coder-claude-006)

Maintainer decision 2026-11-02 (chat, "paßt" to the lead's proposal). The background: reviews whose cites were right but whose text was invented (#1154, and earlier #975, #1010). Our team works around this with a pre-send script (check_review.py) and a script check by the review lead. Maity should give every team this check, not just ours.

1. The CLI checks the text of a review (contract §8.4, then CLI):
maity say --type review_result already checks every cite against the head in the local clone. It now also checks the free text:

Anything in backticks that looks like a path, function, test or key must exist in the reviewed head (git ls-tree, git grep -F).
path:line references must name an existing file and line.
Commit hashes must exist (git cat-file -e).
Commands in an "Ran" section are exempt.

On a failure the CLI stops with a clear list of what didn't match. It sends nothing. With no head available locally, it warns instead of stopping. Prose in backticks causes false alarms, so the contract defines what counts as checkable.

2. Built-in rules for the reviewer role: the rules every agent gets at join and in the rules digest say:

use a fresh context for each review;
the checker writes the text, and it is sent unchanged;
list everything you ran under "Ran".

3. Proposal, not part of this card: the dashboard shows on a review whether the CLI checked it.

Contract PR first, then CLI.