fix(ce-code-review): bind finish workers to the reviewed checkout

[arimetabot]

Summary

Fresh review workers now receive the checkout that produced the diff instead of relying on their inherited working directory. This prevents a same-branch, same-HEAD checkout with different staged changes from being treated as the reviewed tree.

The binding is captured during scope collection and checked by finish leaves and validators. The index is fingerprinted separately because an unstaged edit can cancel a staged change in the working-tree diff. Remote reviews retain their existing reviewed-ref rules; local apply authority is unchanged.

Fixes #1844.

Validation

• Focused regression suite: 139 passed. Includes same-HEAD clones with different staged contents and an index change hidden by restored working-tree contents.
• Skill guards: 798 passed, 9 skipped. Typecheck and release metadata validation passed.
• Full suite on Bun 1.4.2 with the catalog's historical refs fetched: 4,518 passed, 10 skipped, zero failures (175 files). The first runs exposed Bun 1.3.14 runner-format failures, a timeout, and missing historical refs; the final run passed without changes to those tests or the global runtime.
• A fresh Codex source-read canary selected the correct synthetic checkout after verifying root, HEAD, index, and tracked diff. This did not exercise a complete merge/validator/report round, remote scope, or an apply batch. An independent Codex review found the late-capture ordering issue; scope collection now loads the binding contract before producing the diff, with an early-load regression guard.
• A second fresh Codex canary followed the updated Stage 1 procedure and captured the original root, HEAD, index and tracked-diff hashes before review. The fixture's HEAD, hashes and porcelain were unchanged afterward. This bounded canary omitted full-round stage logging.
• Claude behavioral evaluation was not run: this contribution's execution policy permits Codex-native review only. Plugin schema validation is left to upstream CI, as permitted by CONTRIBUTING.md.

No installed plugin or host configuration was changed. No claim is made about time or token savings.

Security Disclosure

This changes checkout-path and state-validation instructions. Missing or mismatched local bindings stop finish or leave validation unresolved. The checks assume a trusted, cooperative checkout; they are not a sandbox and do not prevent concurrent changes between verification and use. No dependencies, credentials, permissions, or external-provider routes changed.

Agent Disclosure

• Model: Codex desktop; GPT-5 family label exposed in context. Exact served model is unverified.