fix(review): build the GSTA-160 floor on #3660's floor words; pin the changed briefs under a pending GSTA-160 replay entry

The resolver floor now extends lib/review-scope.ts BLOCKING_FLOOR (the prose voices' copy) with
the security clause, so every copy contains #3660's floor words and the voices stay at G1 bytes.
fix-check carries the sentence literally for the F10 copy check. Two review-skill lines are
shortened to keep the generated SKILL.md size pins from growing.

Replay: 4c53e80a (pre-#3660 wording); GSTA-167 cohort no-loss arm on these bytes pending.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

scripts/resolvers/fix-check.ts

@@ -3,8 +3,6 @@
  * step whose fixes do not earn a full pass. It reads the fixes, never the whole diff. The parent
  * writes every input in literally: a reviewer never sees the parent's shell.
  */
-import { BLOCKING_FLOOR } from './review-floor';
-
 export interface FixCheckInput { fixList: string; touchedHunks: string; callers: string; testResults: string }
 
 export const FIX_CHECK_INSTRUCTIONS = `You are the fix-check reviewer for a pre-landing review. An earlier review pass found
@@ -16,8 +14,9 @@ fails open (accepts what it refused) or fails closed (refuses what it accepted),
 behaviour the code had before the fix, an error or unreadable state now read as success, a test
 made weaker. Name the input or call site that reaches each defect.
 
-Rate each finding against the blocking floor. ${BLOCKING_FLOOR} Output one JSON object per
-line, {"severity":"CRITICAL|INFORMATIONAL","path":"<file>","line":<n>,"summary":"<what breaks, for which input>"},
+Rate each finding against the blocking floor. CRITICAL is the blocking floor: a finding that
+would fail a test, break production, or lose data or secrets, or open a security hole (injection,
+auth bypass, secret exposure). Everything else is INFORMATIONAL. Output one JSON object per line, {"severity":"CRITICAL|INFORMATIONAL","path":"<file>","line":<n>,"summary":"<what breaks, for which input>"},
 or the two words NO FINDINGS when the fixes are sound.`;
 
 export function renderFixCheckPrompt(i: FixCheckInput): string {

scripts/resolvers/review-army.ts

@@ -153,7 +153,7 @@ A defect the diff causes but that shows elsewhere (a caller broken by a changed
 Leave extraction advice to the core shared-code check; report real defects in duplicated code independently, keep advisory metadata on structural advice, and never call a demonstrated defect advisory because a shared helper could fix it.
 
 For a finding a test could catch, add a minimal \`test_stub\` skeleton in the detected test
-framework ({TEST_FW}); skip it for architectural or design-only findings.
+framework ({TEST_FW}); none for architectural or design-only findings.
 
 Output nothing else: no preamble, no summary or commentary.
 

scripts/resolvers/review-floor.ts

@@ -1,6 +1,9 @@
 /**
  * The blocking floor every gstack reviewer prompt carries (docs/review-policy.md#the-blocking-floor).
  * One sentence, so the core checklist, each specialist and the fix-check rate severity the
- * same way. test/review-severity-floor.test.ts keeps the markdown copies in step.
+ * same way. It extends lib/review-scope.ts's floor words (the prose voices' copy) with the
+ * security clause. test/review-severity-floor.test.ts keeps the markdown copies in step.
  */
-export const BLOCKING_FLOOR = 'CRITICAL is the blocking floor: a finding that would fail a test, break production, lose data or secrets, or open a security hole (injection, auth bypass, secret exposure). Everything else is INFORMATIONAL.';
+import { BLOCKING_FLOOR as FLOOR_WORDS } from '../../lib/review-scope';
+
+export const BLOCKING_FLOOR = `CRITICAL is the blocking floor: a finding that ${FLOOR_WORDS}, or open a security hole (injection, auth bypass, secret exposure). Everything else is INFORMATIONAL.`;