fix(advisor): avoid nested context mount

[cv]

Outcome

PR Review Advisor specialist sandboxes can provision their immutable context without a nested bind mount beneath the read-only PR worktree.

Reason

The specialist-only refactor mounted prepared context at /pr-workdir/.pr-review-advisor-context after /pr-workdir had already been mounted read-only. Docker could not create the nested mountpoint and rejected sandbox startup.

Changes

• Read specialist diff evidence from the specialist directory already included in the top-level read-only advisor context mount.
• Remove the redundant nested bind mount beneath /pr-workdir.
• Assert that generated Docker mount targets never nest beneath the read-only PR worktree.

Verification

• Contributor validation: Commit pre-commit and commit-msg hooks passed; npm run validate:pr passed.
• Tests: npx vitest run --project integration test/automation/pull-requests/pr-review-advisor-openshell.test.ts (43 passed); npm run validate:pr (passed in an isolated clean worktree with current built artifacts)
• Broad gate: npm run validate:pr
• Secrets review: The diff contains no secrets, API keys, or credentials

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 900eecd in the fix/advisor-context-... branch remains at 96%, unchanged from commit 96fd111 in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit 900eecd in the fix/advisor-context-... branch remains at 84%, unchanged from commit 9322588 in the main branch.

Show a line coverage summary of the most impacted files.

File	main 9322588	fix/advisor-context-... 900eecd	+/-
src/lib/onboard...uild-context.ts	74%	74%	0%
src/lib/sandbox...rce-identity.ts	82%	82%	0%
src/lib/runner.ts	75%	76%	+1%

---

_{Updated September 01, 2026 01:31 UTC}