fix(review): stop delegating six categories to a pass that never runs

The checklist told the reviewer that Test Gaps, Dead Code, Magic Numbers,
Conditional Side Effects, Performance and Bundle Impact, and Crypto and
Entropy were 'handled by parallel subagents, NOT this checklist', and
pointed at review/specialists/, a 1.x path absent from this tree. Nothing
dispatched that pass. review.md:694 says so itself: 'If no specialist
pass was dispatched, as in this module's default flow'. The severity
table then listed seven specialists as a third column of coverage that
never executed.

So six categories were actively excluded and picked up by nobody. A
hostile-field persona planted an unauthenticated file-read endpoint and
it passed the Normal rubric clean. A rubric that names a category it
never checks is worse than one that omits it, because the omission is
invisible to the reader.

Those categories are now a Pass 3 the reviewing agent runs, kept short on
purpose: a competent reviewer already knows what an N+1 query is, so only
the traps that hide are written down. Access control leads it, including
the path-traversal and unauthenticated-read case the field test caught.
The seven orphaned specialist files (17,115 B, zero routes, absent from
every lazy row of the context bill) are deleted, their non-obvious checks
folded in at 1,700 B.

Net: 375 deletions against 100 insertions, and the coverage is real.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: 2 people