Make read-only shortcut review optional and enforce completion gates

[areshand]

Read-only repository investigations currently require an independent model reviewer through the compatibility command, while the newer observe/auto routes omit several deterministic completion checks. Make the reviewer optional and apply the common completion checks consistently.

• Allow complete --read-only --result-file PATH without a reviewer. Explicit --reviewer calls still require matching sealed evidence and now verify its recorded output hash.
• Reject successful observe/auto completion with unfinished or writable launches, started source lifecycle state, changed repository source, unresolved TODOs/blocking findings, or reviewed operation receipts/published requests.
• Preserve human escalation with unresolved work, mandatory source plan-alignment/technical reviews, and all operation authorization and pre-execution ops review.
• Update AD-014, role/routing prompts, the safety assessment, and the canonical backlog.

Validation: 94 Rust unit tests, 20 CLI migration contracts, the complete shell contract suite (tests/run.sh), mock orchestration E2E, lifecycle regressions, formatting, and diff checks passed. Shell tests use system /bin/bash; the initial Homebrew Bash invocation stalled during mock fixture setup.

Linux UID/Landlock and real deployed prod-mcp integration were not verified on this macOS host. Deployment acceptance and the pre-existing external-only pending-request/live-role accounting gap remain explicit TODOs. No production operation or deployment was performed.

Based on freshly fetched origin/main at fcf23b6.