review pins: GSTA-258-L7 planner no-loss replay admits the new depth rules; changelog fragment

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

changelog.d/gsta258-l7-review-classing.md

@@ -0,0 +1,9 @@
+**/ship's review depth now follows what the code does, not what a file is named (GST-1177).** An executable file stays code wherever it sits, and code that seals eval custody or decides what reaches an outside model now gets full review. Over the last 200 commits on main, no commit's review depth went down; five went up, including the secret-egress fix in #3921 that had been planned light.
+
+### Changed
+- **An executable is code whatever its name or folder.** A file with the exec bit or a `#!` first line, like `scripts/logs/prune` or a runnable `*.out`, no longer counts as a run log or data. If gstack can't read a file's mode or first bytes, it treats the file as executable.
+- **Sealed custody and outside-model egress are security risk.** Paths naming seal, sealed, custody or egress, and code lines that call a redaction function, import a redaction or outside-voice module, or set a `SECRET` or `CREDENTIAL` constant to a regex now plan full depth (harness-evals#237, #3921).
+
+### Fixed
+- **The outside voice's path-scoped slice no longer drops files with quoted or spaced names.** A file git prints with a quoted header, which can happen when the name has a tab or non-ASCII characters, was either glued onto the file before it or silently left out of a diff over 2 MB. Now each one is its own file, and the brief names it when it's left out.
+- **docs/ship-policy.md describes the `review` policy key** and the `risk` and `mode` fields of the receipt's `review_depth` record.

test/fixtures/review-pins/files/lib/review-depth.ts.json

@@ -1 +1 @@
-{"sha":"fb21c0b80e98685ca8c5192aeaa217cfffe9fbdaa8890455c97e01be1b044a53","replay":"GSTA-258-C+GST-940"}
+{"sha":"17617e1ecfc9cf91cd1df564363a67439bb1d451e07e98d38350b79905ec49ec","replay":"GSTA-258-L7"}

test/fixtures/review-pins/files/lib/review-risk.ts.json

@@ -1 +1 @@
-{"sha":"e2a4d2aabe02e28140b3b8f3d5288bf0eac1872b5cb375eb011e4f0cde2ad67a","replay":"GSTA-258-C+GST-942"}
+{"sha":"31601b6b07f1be146652ed308f130b4a9688bddc08500d94e03696c372c8f67d","replay":"GSTA-258-L7"}

test/fixtures/review-pins/replays/GSTA-258-L7.json

@@ -0,0 +1 @@
+{"replay":"GSTA-258-L7","justification":"GSTA-258 L7 planner no-loss check (GST-1177, Addenda 1 and 7): the change only adds triggers (executables stay code; seal, sealed, custody and egress path tokens; redaction calls, redaction or outside-voice imports and SECRET or CREDENTIAL regex constants are security) and removes none; over the last 200 first-parent main commits to bf2cab34c5, planReview and collectCommit from origin/main and from this branch give the same depth, class, risk classes, next step and dispatches on 195, and the other 5 only raise: ed5c948eb6 (#3921, the GST-1164 secret-egress fix) and c197a139b7 (#3918, approval text in public PR bodies) and 514daebf5f (#3569, lib/sealed-guard.ts) go light to full on security, while 90a170c941 and 71acd83aa6 gain security at unchanged full depth and reviewers; no commit's depth drops (GStack Minder drive handoffs/GSTA-258/L7-planner-noloss/)"}