fix(entry-review): harden against malformed model verdicts

[recursix]

Problem

The entry-review job crashed on PR #70 (waa entry) with:

TypeError: string indices must be integers, not 'str'
  format_verdict_comment → v = verdict["checks"][k]   (entry_review.py:217)

The submit_verdict tool schema requires checks to be an object, but Anthropic tool-use does not hard-validate tool inputs against the schema, so the model occasionally returns checks as a string (or omits keys). Downstream code assumed the documented shape and crashed.

Impact: the crash fails the workflow step → downstream success() is false → both auto-merge and request-review skip (quick-check.yml#L362), leaving the PR with a red check and no actionable feedback. (#70 merged manually as a result.) This is the source of the recent "Entry Pipeline" failure emails.

Fix

Add normalize_verdict() and call it at the call_claude boundary so it always returns a well-formed {verdict, checks, notes} dict:

• invalid / missing individual check values default to "unverified";
• an unparseable structure (checks not an object) downgrades the verdict to UNKNOWN — route to manual review, never auto-merge a result we couldn't read;
• mirrors the existing UNKNOWN fallback already used for transient API errors.

This is a robustness fix only — no security boundary or schema change.

Tests

5 new cases in TestNormalizeVerdict covering the original string-checks crash, missing/invalid values, invalid verdict enum, and non-dict input. Full suite green (28 passed); ruff check + format clean.

🤖 Generated with Claude Code