Improve GitHub App review precision with pinned source context and evidence-based findings

[Hmbown]

Founder requested higher-quality coding feedback specifically from the GitHub App that reviews pull requests. The verified published review on PR #5842 uses the Actions-backed codewhale review --pr --post path; its claim that matching RegistryMutation twice necessarily moves it needs a compiler-backed negative control.

Executing owner: Codex, this GitHub review-quality task. C06 behavioral quality reference; this is not Auto-Review permission policy. Claim exact paths in an isolated Codewhale worktree: crates/tui/src/tools/review.rs, crates/tui/src/tools/review_pr.rs, crates/tui/src/tools/review_hunks.rs, the review prompt assembly hunk in crates/tui/src/lib.rs, and docs/GITHUB_APP.md. Preserve the shared checkout's dirty lanes.

Scope: reuse the shared PR snapshot and hunk authority to supply bounded surrounding source from the exact head, retain the complete original diff and existing input/pass budgets, make missing context explicit, strengthen the reviewer contract around reachable introduced defects, actionable fixes and honest validation. Verify pinned-head/dirty-checkout isolation, source bounds and anchors with local fixtures; run npm test && npm run check:web and focused Rust checks.

Evidence lanes remain separate. Local implementation and commits only; no provider calls, public push, posted review, deployment, or new model budget is authorized by this slice.

[Hmbown]

Triage (v0.9.14 run, blocked (authorization) — not in #6161): the slice authorizes local implementation only; the founder-visible outcome (a posted GitHub App review) is unverifiable inside it. Local target exists (tools/review_hunks.rs); the verification substitute is local fixtures for pinned-head isolation + source bounds, and the compiler-backed negative control on RegistryMutation remains owed.