Complete exact-head Review Suite closure

[Pimpmuckl]

Summary

• complete the bounded exact-head conformance and cleanup closure, including head-change rewinds and accepted-finding persistence
• consolidate closure behavior across the Review Suite entry points and keep deslop skipping an explicit CLI choice
• make explicit Windows-to-WSL UNC review launches read-only with exact process-local Git trust; remove yolo launch paths, automatic environment/registry authorization, and unsafe warnings

Validation

• 198 focused runtime, gate, wrapper, follow-up, deslop, and Arena tests
• 644 full plugin tests
• Ruff format and check
• bounded disposable Windows codex.CMD to WSL UNC probe: sandbox=read-only, no yolo flag, exact appended safe.directory, exact Git reads, blocked write, unchanged parent/head/status/global config, validated cleanup (29.793s total)
• Review Suite fast: rvw_45a82eb3 clean on exact head ecb06856df7a32ea101d8cae74249a90554646b6

Operator gates

This PR does not merge to main. No local plugin sync/install or dogfood was performed; those remain architect/operator gates.