feat(review): add advisory finding utility contract

[zzwong]

Summary

Add the pure, advisory-only contract for evaluating code-review finding utility. This foundation defines typed state and question schemas, deterministic fail-safe policy behavior, canonical provenance, duplicate handling, and verifiable audit records without connecting the feature to the review pipeline.

Changes

• define the six-object evaluator state, 13 binary judgments, utility and duplicate choices, and optional diagnostic score
• add deterministic guards that keep protected, incomplete, uncalibrated, unaudited, or otherwise uncertain findings
• preserve raw findings and enforce effective_decision: keep for every advisory record
• add canonical digest, duplicate-finalization, artifact-integrity, and symlink-containment checks
• add synthetic fixtures and focused regression tests for protected risk, missing context, strict thresholds, malformed responses, duplicate cycles, prompt injection, and label leakage

Testing

• go test ./internal/findingutility -count=1
• go test -race ./internal/findingutility -count=1
• all JSON fixtures validated with jq
• go build ./cmd/cr
• git diff --check

The full repository test run reached the existing installed-Pi integration test and failed because the host selected Node 18, while the installed Pi bundle imports node:fs.globSync. The package under this PR and the remaining Go packages passed. Repository lint also could not type-check Go 1.27's standard-library math/rand/v2 with the installed linter.

Scope limits

This PR does not add a provider transport, network or credential access, calibrated thresholds, production suppression, pipeline integration, CLI flags, ledger changes, or a development binary. Exported runtime policy remains non-applying; only private test helpers exercise suppression signatures.