Fix care-plan review loop: route on decision, fail closed

[khaledsulayman]

Sam flagged verifying the reject/feedback loop — it was broken, in the fail-open direction.

Bug

The UI + contract (ReviewAction) submit the review outcome as decision, but the workflow switch and BFF state derivation keyed on .action, which is never present:

• Workflow CheckCarePlanReview (acp-writer-workflow.yaml) — .careplanReview.action == "approve" | "request_changes", with defaultCondition: WriteFHIR.
• BFF sonataflow_client.py — infer_current_state / map_to_run_detail read .get("action").

Since .action is always null, every review fell through to the default → WriteFHIR. So clicking “Request changes” (reject) silently wrote the plan as active instead of looping to regenerate, and previousFeedback/reviewIteration never reached the UI. Approve only “worked” because the default happened to also be WriteFHIR.

Not caught earlier because the mock BFF (#136) and MSW mocks key on the contract field decision — only the real SonataFlow path had the mismatch.

Fix

• Workflow: route on .careplanReview.decision; change defaultCondition from WriteFHIR to ReviewCarePlan so an unrecognized/missing decision fails closed (never auto-writes) — ties to Harden clinical review pipeline to fail safe #47.
• BFF: infer_current_state + map_to_run_detail read .decision for routing state and previousFeedback.
• Tests: test_bff_review_mapping.py covers approve→WriteFHIR, request_changes→GenerateBundle loop, and previousFeedback on round 2. Verified failing on the old .action code, passing after.

The UI is already correct (sends decision per the contract); no UI change needed.

Deploy note

Workflow change is oc apply (SonataFlow dev profile, no build); the BFF change needs an acp-writer-bff image rebuild + rollout.

_{Generated by Claude Code under the supervision of Khaled Sulayman}