Phase A + B (MVP) — local review harness

Implements the MVP cutline from the planning artifact:
- Phase A: skeleton + CLI dispatch + provider interface + stub model doctor
- Phase B: scanner + git probe + 12 static analyzers + reporters + pipeline
- Phase B fixtures: clean-repo, insecure-repo, degraded-repo

12 static analyzers per PROMPT.md "Suggested Static Checks For MVP":
hardcoded_paths, shell_execution, raw_sql_interpolation, broad_cors,
secret_patterns, large_files, todo_comments, missing_tests,
env_file_committed, unsafe_file_io, exposed_mutation_endpoint,
hardcoded_local_ip.

Acceptance gates passing:
- B1 (intake produces accurate counts) ✓
- B2 (insecure fixture fires ≥8 distinct check_ids — actually 11/12) ✓
- B3 (clean fixture produces 0 confirmed findings — no false positives) ✓
- B4 (scrum mode produces all 6 required markdown + JSON reports) ✓
- B5 (receipts.json marks degraded phases honestly) ✓
- F  (self-review on this repo runs without crashing) ✓ — exit 66 (degraded
  because Phase C LLM review is hardcoded skipped)

Phases C (LLM review), D (validation cross-check), E (memory + diff +
rules subcommands) deferred per the cutline. The MVP delivers the
evidence-first path; LLM is purely additive.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/fixtures/clean-repo/README.md

@@ -0,0 +1,2 @@
+# Clean fixture
+A sterile repo. Static analyzers should find nothing confirmed.

tests/fixtures/clean-repo/package.json

@@ -0,0 +1 @@
+{"name": "clean-repo", "version": "0.1.0"}

tests/fixtures/clean-repo/src/calc.ts

@@ -0,0 +1,7 @@
+// Pure utility — no patterns the analyzer is looking for.
+export function add(a: number, b: number): number {
+  return a + b;
+}
+export function multiply(a: number, b: number): number {
+  return a * b;
+}

tests/fixtures/clean-repo/tests/calc.test.ts

@@ -0,0 +1,4 @@
+import { test, expect } from "bun:test";
+import { add, multiply } from "../src/calc";
+test("add", () => { expect(add(2, 3)).toBe(5); });
+test("multiply", () => { expect(multiply(2, 3)).toBe(6); });