repo-sweep review: dispatch an independent reviewer instead of self-auditing the step

[kyle-sexton]

Problem

skills/repo-sweep/reference/review.md step 1 asks the session that ran the step to list what went wrong, adding "anything you saw yourself". SKILL.md says each action runs in a fresh session, but only a manual /clear between next and review makes that true. Without it, the agent that did the work grades its own work.

Evidence

In the provenance step of melodic-software/.github#153, the executing session reported a clean [x] no findings. A separate reviewer agent, given only the procedure files and the step's .work/ artifacts, found 13 problems. They included roughly six candidates that skipped required judging, a hand-built findings-file timestamp, and a tick taken before the user reviewed the findings.

Fix

• review.md: dispatch a separate reviewer agent. Give it the procedure files (repo-sweep next.md, the step skill's SKILL.md and references), the step's artifacts (.work/, the PR checklist line, the step diff or the absence of one), and the user's complaints. Never give it the executing agent's reasoning or transcript. It returns a classified problem list: skill defect, catalog defect, executing-agent error, harness issue.
• The main session merges that list with what the user reports, then drafts issues as today.
• SKILL.md: state that the reviewer is never the agent that ran the step.

[kyle-sexton]

Issue stays closed. Audit follow-up in #5295 (Refs only). This comes from the 2026-09-29 audit of the unattended Cursor run.

The audit found review.md did not ask the user first, passed the executing session's own observations to the reviewer, and routed only some reviewer classes. On the branch, review.md asks the user first, then dispatches the reviewer with the complaints, drops the executing session's self-observations except guard.sh stop lines, and routes all four reviewer classes (executing-agent error and harness issue included).