fix(actions): bound agent mention dispatch envelopes - #1021

Test-first state

This Draft currently contains only focused regression contracts for the central review-agent mention transport. The production code is intentionally unchanged so the exact branch records the current failure before repair.

The reproduced defect is concrete: the router emits 14 top-level repository_dispatch.client_payload properties for @opencode-agent, while GitHub accepts at most 10. Recent mention-router runs fail with HTTP 422 before the authoritative review scheduler is queued, blocking exact-head OpenCode review requests across CWL repositories.

The regression contract also requires:

• a versioned three-key envelope whose nested claim preserves the existing invocation digest and artifact-ledger identity;
• validation before durable ledger mutation on both dispatch hops;
• exact live head, base, and base-branch binding at the scheduler;
• review-only policy (merge_mode=disabled, no branch update, no auto-merge);
• legacy dispatch compatibility without allowing the versioned envelope to fall through the legacy event;
• optional reaction failure to remain advisory after durable dispatch;
• 100% production coverage and docstring coverage for the affected router and scheduler modules.

This is the bounded successor to stale, conflicted PR #840. It deliberately excludes that PR's unrelated uv materializer, Strix, broad OpenCode, and documentation changes.

Do not merge in the RED state.