review: default review.panel all, one-reader shape opt-in (GSTA-258 build C, option B)

Today's reviewer panel stays the default dispatch. review.panel risk (and off)
opt in to the one-reader shape, whose no-loss replay came back FIX-METHOD
(readers saw only the diff, no repository: 2/68 non-risk blockers).
Raise-only additions stay on by default: HARN-1, eval and policy classes,
GST-1129 spend-binding money and --declare-risk, doc secrets. Platform depth
stays off by default.

Repins ship/sections/review-army.md, ship/sections/adversarial.md,
lib/review-depth.ts and lib/review-risk.ts under no-loss check GSTA-258-C:
the planner over the last 200 first-parent main commits to 6f1dfd5b7c plans
the same depth, classes and dispatches on 196 and only raises on the other 4;
brief bodies still hash to their pins.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

docs/review-policy.md

@@ -182,11 +182,13 @@ A plan that fails closed to full exits 0; a diff git cannot list exits 1.
 ### Who reads (R65, the base policy's `review` key)
 
 The depth says how much review a diff needs; the base branch's `.gstack/ship-policy.json`
-`review` key says who does it (`review.panel`, default `risk`). `gstack-review-plan`
+`review` key says who does it (`review.panel`, default `all`: today's panel on every class). `gstack-review-plan`
 prints `REVIEW_MODE: <lean|panel|platform> panel=<p> reader_model=<m> platform=<on|off>`
 and, under `review.platform on`, `PLATFORM_REVIEW: <id> reviewer=capy-ai[bot] head=<sha>`
 or `PLATFORM_REVIEW: none (<reason>)`.
 
+Under the opt-in `review.panel risk` (and `review.platform on` under any panel):
+
 | Diff | Pass 1 | After fixes (never more than 2 rounds) |
 |---|---|---|
 | Risk class: gate class, an R51 class (money, auth, secret, security, data), `eval` (scorer, judge and grader paths) or `policy` (`review.risk_paths`) | The full-depth plan as printed: the batched specialist, Red Team, native adversarial, outside voice and the targeted reader | A fixed blocker re-runs the printed plan on the fixed head as round 2; below-floor fixes get one fix-check |
@@ -194,7 +196,9 @@ or `PLATFORM_REVIEW: none (<reason>)`.
 | Docs and tests | The core read; the outside voice only when the diff publishes numbers | One fix-check after a fixed blocker |
 | Docs or tests with no numeric, results or prereg claims, under `review.platform on`, with capy-ai[bot]'s review on the PR at HEAD | No reader: `NEXT: platform` and a planned `SKIP:` for every reader, the core read included | none |
 
-`review.panel all` keeps today's panel and loop on every class; `review.panel off` gives
+`review.panel all`, the default, keeps today's panel and loop on every class. `risk` is
+opt-in because its one-reader shape has not passed its no-loss replay: build C's replay
+scored it FIX-METHOD (its readers saw the diff without the repository). `review.panel off` gives
 risk class one merged reader too (`DISPATCH: adversarial-native merged`: the native
 adversarial brief, the gate-class checklists, the Red Team checklist and the targeted
 brief, whose ledger record is the receipt's `review_targeted`). The risk classes come