review: default review.panel all, one-reader shape opt-in (GSTA-258 build C, option B)

Today's reviewer panel stays the default dispatch. review.panel risk (and off)
opt in to the one-reader shape, whose no-loss replay came back FIX-METHOD
(readers saw only the diff, no repository: 2/68 non-risk blockers).
Raise-only additions stay on by default: HARN-1, eval and policy classes,
GST-1129 spend-binding money and --declare-risk, doc secrets. Platform depth
stays off by default.

Repins ship/sections/review-army.md, ship/sections/adversarial.md,
lib/review-depth.ts and lib/review-risk.ts under no-loss check GSTA-258-C:
the planner over the last 200 first-parent main commits to 6f1dfd5b7c plans
the same depth, classes and dispatches on 196 and only raises on the other 4;
brief bodies still hash to their pins.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

lib/review-depth.ts

@@ -549,7 +549,8 @@ export function planReview(i: PlanInput): ReviewPlan {
   const depth = decideDepth(c, c.runtimeLines ?? (CLASS_RANK[c.class] >= CLASS_RANK.code ? i.diffLines : 0), i.floor);
   const { class: cls, runtimeLines } = depth;
   const sh = i.shape;
-  const panel = !sh || sh.panel === 'all' || (sh.panel === 'risk' && riskClass(c, depth));
+  const platformNow = !!sh && sh.platform === 'on' && sh.platformReview?.head === sh.head && i.history.fullPasses === 0 && !riskClass(c, depth) && platformFits(i.paths, depth.runtimeLines, i.numbers);
+  const panel = !platformNow && (!sh || sh.panel === 'all' || (sh.panel === 'risk' && riskClass(c, depth)));
   const next = nextStep({ ...i.history, gate: cls === 'gate', adversarialRan: !!i.adversarialRan, lean: !panel }, depth.depth);
   if (!panel) return leanPlan(i, c, depth, next);
   const h = i.history;

lib/ship-policy-review.ts

@@ -6,7 +6,7 @@
  * paths to R51's risk classes.
  */
 export interface ReviewPolicy { panel: 'off' | 'risk' | 'all'; reader_model: string; platform: 'off' | 'on'; risk_paths: string[] }
-export const REVIEW_POLICY_DEFAULT: ReviewPolicy = { panel: 'risk', reader_model: 'lane', platform: 'off', risk_paths: [] };
+export const REVIEW_POLICY_DEFAULT: ReviewPolicy = { panel: 'all', reader_model: 'lane', platform: 'off', risk_paths: [] };
 const MODEL = /^[A-Za-z0-9][\w./:-]{0,127}$/;
 
 /** The key with every omitted field at its default (a policy file may set any subset). */

lib/ship-policy.ts

@@ -159,7 +159,7 @@ export const DEFAULT_POLICY: ShipPolicy = {
   stamp_sensitive_gates: [],
   review_scope: 'frozen',
   review_exclude_paths: [],
-  review: { panel: 'risk', reader_model: 'lane', platform: 'off', risk_paths: [] },
+  review: { panel: 'all', reader_model: 'lane', platform: 'off', risk_paths: [] },
   pr_count: { default_pr_count: 1, split_requires_owner: true },
   maintainers: [],
   stamp_files: [],
@@ -192,7 +192,7 @@ export const POLICY_EXPLANATIONS: Record<PolicyKey, string> = {
   stamp_sensitive_gates: 'Evidence labels (gstack-evidence --label) that read VERSION or generated bytes; the tree receipt never marks them reusable.',
   review_scope: 'frozen | diff-plus-blocking | all. frozen (default): /ship Step 9 fixes findings in the diff on pass 1, files blocking findings in code the PR did not change as issues, and later passes read only the range since the previous pass and fix only blocking findings; diff-plus-blocking: the same, but a blocking finding in code the PR did not change is fixed in this PR instead of filed; all: every finding is fixed now (the pre-1.91.249 loop).',
   review_exclude_paths: 'Git glob pathspecs, root-anchored and case-sensitive (`receipts/**`, `**/*.jsonl`; at most 64, 256 characters each, no leading `:` or `!`): /ship\'s reviewers leave out the data, docs, binary and .log files they match. Read from the base branch only, so a branch cannot exclude its own files. Code, gate paths, agent prose, config, executables, .gstack/ and .github/ files, gate-tagged or secret-bearing files and files a kept code or test file names by full path stay reviewed (docs/ship-policy.md#review-exclude-paths).',
-  review: '{ panel?, reader_model?, platform?, risk_paths? }, read from the base branch only. panel: risk (default: today\'s panel at full depth on risk class, one reader on the rest) | off (one merged reader on risk class too) | all (today\'s panel and loop everywhere); every value but all runs one fix round. reader_model: the model of the one reader a lean depth runs, `lane` (default: the lane\'s own model, the native adversarial reader), `cross-family` or a model id. platform: off (default) | on: a docs or tests diff with no numeric, results or prereg claims whose PR carries the platform review (capy-ai[bot]) at the exact head skips /ship\'s readers (review_depth platform); never runtime code. risk_paths: globs of code paths that are risk class on top of R51\'s; data, docs and binary files under them stay out (docs/review-policy.md#review-depth).',
+  review: '{ panel?, reader_model?, platform?, risk_paths? }, read from the base branch only. panel: all (default: today\'s panel and loop everywhere) | risk (opt-in: today\'s panel at full depth on risk class, one reader on the rest) | off (one merged reader on risk class too); risk and off run one fix round. Their one-reader shape has not passed a no-loss replay yet (GSTA-258 C: FIX-METHOD). reader_model: the model of the one reader a lean depth runs, `lane` (default: the lane\'s own model, the native adversarial reader), `cross-family` or a model id. platform: off (default) | on: a docs or tests diff with no numeric, results or prereg claims whose PR carries the platform review (capy-ai[bot]) at the exact head skips /ship\'s readers (review_depth platform); never runtime code. risk_paths: globs of code paths that are risk class on top of R51\'s; data, docs and binary files under them stay out (docs/review-policy.md#review-depth).',
   pr_count: '{ default_pr_count, split_requires_owner }: the PR-count row in plan reviews.',
   maintainers: 'GitHub logins treated as maintainers by /review contributor mode; empty uses repository push permission.',
   stamp_files: 'The repo’s stamp rule: globs of the only files that may differ by a stamp (version file, manifests, plugin trees, the PR’s own since: rows). Empty keeps gstack’s per-file rules; set, it applies before every rule.',