fix: make review posting deterministic

[factory-nizar]

Summary

• make submit_review atomic and idempotent per MCP process, with a hard refusal after a successful or in-flight submission
• enforce action-side turn limits for both review passes (100 candidate turns, 40 validator turns) without retrying runaway sessions
• make the validator file-only and post review_validated.json through one deterministic GitHub API call
• validate diff anchors, bound GitHub payloads, and render posting results in the tracking comment
• share validated-review, diff-index, review-posting, and result-parsing primitives with the GitLab flow

Validation

• bun test (618 passed)
• bun run typecheck
• bun run format:check
• git diff --check

[factory-droid]

Droid finished @factory-nizar's task —— View job

---

The deterministic posting flow has two high-confidence gaps: it does not pin the review to the validated head commit, and the file-only validator still exposes a write-capable GitHub token to shell execution.

[factory-droid]

[P1] Pin the review to the validated commit

The validator emits commit_id, but this parser drops it, so the deterministic GitHub posting request defaults to the PR's latest head. If a commit is pushed after pr.diff is generated, GitHub resolves the old anchors against the new head and can reject the atomic review or attach findings to different code; preserve the validated SHA and pass it as the review's top-level commit_id.

[factory-droid]

[P1] [security] Remove GitHub credentials from the validator process

The file-only validator still enables Execute, and every action variant passes GITHUB_TOKEN into the Droid process running with unsafe permission skipping. A prompt injection in the required-to-read PR diff can therefore invoke the GitHub API directly with that token, bypassing this empty MCP configuration and the claimed single deterministic posting call; omit the token from the validator process and expose it only to preparation and posting steps.