feat(action): add fail-closed model policy mode

[l30t]

Summary

• add a backwards-compatible model_policy_fallback input to the main, review, security, and base actions
• support fail mode so policy-blocked or invalid requested models never retry with the organization's default model
• validate strict-mode configuration eagerly and stop deterministic model failures after one attempt while retaining transient retries
• forward strict policy through every review pass, including security model, reasoning, and validator selection
• make debug artifacts unique across retries, jobs, matrices, and repeated action invocations
• keep organization-default as the existing default behavior

Motivation

This is the upstream prerequisite for the CLI-2122 Droid Review migration. Factory's review workflows need to pin review and security models without silently changing models when organization policy or the CLI rejects those pins.

Testing

• bun test (595 passed)
• bun run typecheck
• bun run format:check
• actionlint .github/workflows/*.yml

[factory-droid]

Droid finished @l30t's task —— View job

---

Droid review summary

Solid wiring change overall, with tests covering the new input across action variants. The main gaps are around fail-closed ergonomics: fail mode still retries deterministic model failures, and invalid fallback configuration is only validated on the disallowed-model path.