[Follow-up] Plan Code Review scanner migration for the core replacement #523

Why

Core scanner-replacement planning is tracked by nold-ai/specfact-cli#780 and PR nold-ai/specfact-cli#782. The external Code Review module still invokes Semgrep and distributes Semgrep rule resources. Replacing the core scanner does not automatically migrate that module or prove end-to-end replacement.

Follow-up scope

Track a separate module-side plan once the core candidate and compatibility contract are verified. Inventory run_semgrep, bug and AI-bloat scans, invocation commands and installed bundle behavior. Preserve findings, execution completeness, required rule resources and unavailable-tool diagnostics.

Acceptance criteria

• Validate the actual selected core scanner contract and module ownership before implementation; this issue grants no runtime implementation authority.
• Verify every affected module command path uses the intended scanner and preserves required findings/error semantics.
• Preserve or deliberately migrate packaged clean_code.yaml, bugs.yaml and ai-bloat.yaml rule payloads with bundle-resource tests.
• Apply required module version, checksum, integrity and CI/CD signature follow-up checks to changed bundle assets.
• Retain actual installed-bundle, supported-platform and scanner parity evidence before any end-to-end replacement claim.
• Use spec -> authored tests -> genuine failing evidence -> implementation -> passing evidence for behavior changes.

Relationships and limits

Parent: #163, Validation Evidence And Governance Runtime Follow-Ups. Related core nold-ai/specfact-cli#780 and existing local cutover #515. This issue now blocks core #780 completion at shared Semgrep removal (task 4.4), because required final review must execute clean-code, bug and AI-bloat passes in a fresh delivery environment with Python Semgrep absent. Core candidate investigation and contract proof can proceed first; this issue has no reverse blocked-by edge to core #780. No change to reset ordering or supersession of #513/#514/#515/#516 is intended. Keep their owners and scope. This is follow-up tracking only; core #782 remains planning only, with no module migration, dependency fix, release or promotion claim.