ci: adopt nc-review

[will-lamerton]

Third repository onto the shared review workflow. Two files: the caller, and this project's own rubric — the reviewing method is fetched from Nano-Collective/.github at run time rather than copied.

Why this rubric is not boilerplate

Sentinel's entire output is a claim about someone else's code, so it has one failure mode worse than the rest: a green report over a broken estate. A run that silently fails to scan something tells the operator their repositories are clean when nobody looked — worse than no tool, because a tool gets trusted.

The rubric names the ways that has actually happened here:

• Errors collected and never rendered. packLoadErrors lived on the run report unread; targetErrors was persisted to every run record and displayed on no surface, so a run where every repo failed to clone rendered as "0 findings across 0 repos" in the same calm grey as a clean estate.
• Distinct failures conflated — a missing pack and a pack with an unresolvable depends_on chain reported identically, sending readers hunting for a file already on disk.
• Auto-resolution closing live findings when scanned scope changes. That is the tool reporting a vulnerability fixed because it stopped looking, and it is why [Feature] Incremental scanning, and the auto-resolution fix it requires #17 must land with the cache rather than after it.
• Trusting any existing directory as a checkout of the right repository.
• Model output as untrusted input — Infinity, NaN and fractional line numbers all passed the original range check.

It also gives the review question that catches the whole class: where does this error surface? "It is returned" is not an answer — follow it to the run report, the CLI summary, the run record or the dashboard, or it is discarded.

Two things a reviewer carrying another repo's conventions would get wrong

• test:types typechecks the specs here (since fix(ci): typecheck specs so contract breaks reach the gate #21), so a fixture constructing an exported type without a newly required field is a real error, not a warning.
• clone.ts and gh-client.ts carry /* c8 ignore */ blocks. Logic buried inside one is invisible to coverage and belongs outside it behind an injected seam — which is exactly what fix: validate checkouts before auditing, and honour repeated --rule-pack #23 had to do.

Config

architecture-doc points at docs/workflow/index.md, which the source already cites by section as the design of record. There is no CLAUDE.md here.

Rollout note

Copilot review stays on this repo until nc-review is producing verdicts here — removing it first would leave the repo with no automated review at all, inverting Q7.

pull_request_target resolves the workflow from the base branch, so this PR will not be reviewed by it; the first PR opened after merge will.

[github-actions]

No changeset found

This PR does not add a changeset, so it will not appear in the changelog or trigger a release.

If the change is user-facing, add one:

pnpm changeset

Pick a bump (patch / minor / major) and write the changelog entry in our usual voice ("Added X... Thanks to @you. Closes #123."), then commit the generated .changeset/*.md file.

If this PR is docs-only or a chore that needs no release note, you can ignore this — or run pnpm changeset --empty to record that intentionally.