feat: 0.11.0 stateless Codex push-gate

[himerus]

Summary

Replace the cache-attestation push-review gate (.claude/hooks/push-review-gate.sh, hooks/_lib/push-review-core.sh, the in-flight TS port at src/hooks/review-gate/, rea cache subcommands, rea audit record codex-review) with a stateless pre-push Codex gate.

Net LOC: +3,549 / −26,692 in production; test suite rebuilt on the smaller surface (919 tests pass).

What changes

• git push → .husky/pre-push → rea hook push-gate → codex exec review --json against the actual push target (refspec-aware: remote_sha..local_sha) → parse [P1]/[P2]/[P3] severity markers → .rea/last-review.json + audit record → exit 0/1/2.
• When blocked, Claude reads stderr + the structured last-review.json and fixes. The auto-fix loop IS the retry mechanism — no rea fix-then-push wrapper.
• Codex is the source of truth, fresh every push. No cache. No SHA attestation. No audit-receipt consultation.

Breaking changes (single 0.11.0 changeset)

• Removed subcommands: rea cache check|set|clear|list, rea audit record codex-review
• Removed policy fields: review.cache_max_age_seconds, review.allow_skip_in_ci (rea upgrade strips them and writes a .bak-<ts> backup)
• Removed env vars: REA_SKIP_CODEX_REVIEW, REA_SKIP_PUSH_REVIEW
• Removed hooks: hooks/push-review-gate.sh, push-review-gate-git.sh, commit-review-gate.sh, hooks/_lib/push-review-core.sh (+ .claude/ mirrors). rea upgrade prunes the stale .claude/settings.json entries that referenced them.

Added

• rea hook push-gate [--base <ref>] — the single CLI entry point husky calls. Accepts git's positional pre-push argv silently; consumes refspecs from stdin with a 5s timeout.
• policy.review.concerns_blocks (bool, default true) — when true, [P2] findings block. Per-push override via REA_ALLOW_CONCERNS=1.
• policy.review.timeout_ms (int, default 600_000) — hard cap on the Codex subprocess.
• New env var: REA_SKIP_PUSH_GATE=<reason> — value-carrying, audited; HALT still wins.
• .rea/last-review.json — atomic-write structured dump, redact-scrubbed before disk.

Adversarial review

Ran /codex-review once before push; Codex surfaced four findings (3× P1 + 1× P2):

1. Husky stub assumed rea on PATH — npx @bookedsolid/rea init bootstrap leaves no persistent install → rea: not found on every push. Fixed: stub resolves via node_modules/.bin/rea → dist/cli/index.js (rea's own repo dogfood case) → PATH → npx --no-install.
2. Upgrade didn't prune stale settings — 0.10.x installs would keep invoking deleted push-review-gate.sh. Fixed: added pruneHookCommands() in settings-merge.ts + STALE_HOOK_COMMAND_TOKENS list in upgrade.ts; upgrade now prunes first, merges second.
3. Gate ignored pre-push stdin — git push origin HEAD:release/1.0 reviewed against the wrong base (upstream ladder instead of the actual push target). Fixed: runPushGate accepts a refspecs: PrePushRefspec[] dep; CLI parses stdin; gate diffs remote_sha..local_sha per refspec.
4. Race between exit and stdout drain — codex-runner.ts could parse a truncated buffer and misclassify a blocking review as pass. Fixed: switched exit → close (waits for both stdio streams to end).

All four addressed in commit 63322a5. Dogfood push of this branch exercised the new gate itself and passed cleanly.

Test plan

• pnpm lint — zero warnings, 12 redact patterns + 2 injection patterns cleared
• pnpm type-check — strict, zero errors
• pnpm test — 919 pass, 1 skipped (new push-gate modules: halt, policy, base, codex-runner, findings, report, index, pre-push installer rewrite, pruneHookCommands, refspec parsing)
• pnpm build — clean tsc
• Dogfood: this branch pushed through the new gate. Gate short-circuited at review.codex_required: false (the repo's policy) per design — the full Codex path is proven by the unit tests.

Follow-ups

• Consumer migration proof point: run rea upgrade against Helix's 0.10.x checkout and confirm migration is clean (policy backup + settings prune + husky refresh).