fix(review): resolve the judged revalidation, setup-authority, plan-gate and findings-record ambiguities

The census review workflow judge scored clarity/actionability 3 on both
attempts: smoke-clock limits appeared to forbid post-repair revalidation,
the caller deadline was undefined, 'ask for setup' conflicted with the
report-only browser rule, fallback-sourced HIGH discrepancies had no gate
decision, and the Step 5.8 record omitted adversarial findings.

review/SKILL.md

@@ -823,9 +823,9 @@ Never install, import cookies or bootstrap tests. Functional-only skips browser
 - Required: plan commands/assertions, listed separately. Other ideas are optional, untested.
 
 **3. Run smoke and plan checks.**
-Follow the shared Probe loop for smoke checks, replays and revalidation until the smoke limit.
-Then run required plan checks, even after smoke expires, using the same procedure but no smoke guard; never reset the clock.
-Use finite command timeouts, capped at the caller's remaining time if it has a deadline.
+Follow the shared Probe loop for smoke checks and replays until the smoke limit.
+Then run required plan checks and revalidation, even after smoke expires, using the same procedure but no smoke guard; never reset the clock.
+Use finite command timeouts, capped at the caller's remaining time if it has a deadline. /review sets none; only an invoker-supplied EARLIER_UTC counts.
 Await clock/guard results before acting. When the caller's deadline expires, mark unfinished checks not-run.
 
 **4. Check freshness before reporting.**
@@ -843,7 +843,8 @@ Return verified defects to Fix-First: `path`, `line`, `category`,
 `fingerprint: path:line:category`, replay, `test_stub`. Use checklist severity;
 unmatched functional failures are `functional-contract`, `CRITICAL`.
 Setup/permission blockers are not defects. Test creation needs user approval.
-Ask for setup/permission, never secrets. Unresolved coverage makes Step 5.8 incomplete; a ship waiver cannot complete it.
+Ask only for a named permission or setup the user performs, never secrets. Report-only /review never runs setup, installs or cookie import, even after approval.
+After a grant, recheck readiness and run affected checks; otherwise they stay blocked. Unresolved coverage makes Step 5.8 incomplete; a ship waiver cannot complete it.
 
 **5. Prepare one provisional QA section.**
 Read QA's `templates/functional-report-template.md`. Title it
@@ -1066,8 +1067,9 @@ for the native result, or vice versa. Step 4.8's structured-review gate still ap
 
 - Use Step 4.6's `specialists` object unchanged, including its empty small-diff map.
   If this host omits Review Army, use `specialists: {}` without claiming specialist coverage.
-- Build `findings` from final-pass core, specialist, verified exploratory QA
-  findings and invocation actions. Retain `fingerprint`, `severity`
+- Build `findings` from the final-pass findings Step 5 combined (core, specialist,
+  Step 4.8 adversarial, VALID & ACTIONABLE Greptile and verified exploratory QA
+  findings) and invocation actions. Retain `fingerprint`, `severity`
   (`CRITICAL|INFORMATIONAL`), `action`, and any `advisory`, `evidence_paths`,
   `helper_target`. Recheck source after fixes. The logger uses `sharedLibsFingerprint`,
   never supplied/model hashes.