Add SHA-pinned final-review status gate

[polymath-orchestrator]

Summary

• Add ops/final-review-status.mjs plus tested core helpers for setting/checking a SHA-pinned GitHub commit status in context final-review.
• Update the generated agent workflow contract so autonomous merge requires a current-head final-review success status with verdict=clean reviewer_family=<family> head=<sha>.
• Document that ao native /sessions/{id}/reviews is a separate review system and must not be read as the final-review merge verdict.
• Harden the checker to pick the newest status by timestamp, fail closed on same-timestamp conflicts, validate repo slugs, and validate SHA before API calls.

Verification

• node --test ops/final-review-status.test.mjs
• npm run test:ops
• npm run agents:check
• npx --yes prettier@3 --check .
• git diff --check
• GitHub checks green on 21c316ded3a19940dd62469e2eb0660251497131: Agent instructions, Frontend, Prettier, gitleaks
• Final review: clean, reviewer_family=claude, head=21c316ded3a19940dd62469e2eb0660251497131; posted as final-review commit status and verified with node ops/final-review-status.mjs check ...
• Review threads: none

Closes #114