refactor(review): migrate mechanics to Python and uv

[BjRo]

Why

The review plugin's Bash/AWK mechanics prevented native Windows execution and duplicated parsing across entrypoints. Closes #182.

What changed

Replace the runtime scripts with one self-contained, locked Python/UV package exposing the same seven command names, TSV protocols, scope bindings, reviewer routes, and report semantics. Subprocesses use argument vectors; explicit check commands use Bash on Unix or PowerShell on Windows, with descendant cleanup on cancellation.

Update the skill, references, eval fixtures, and verification/adaptive-delivery consumers to use frozen entrypoints. Add native Python regression/property tests, replace all seven shell regression suites with native Python tests and retained golden reports, register the package, and add Linux/macOS/Windows copied-install and Python 3.10–3.13 CI coverage. Bump all three affected plugins.

Verification

• bun run check:python: passed all nine packages; review has 188 passing tests, 99.11% line coverage and 96.15% branch coverage, plus strict Ruff/mypy gates.
• bun test evals/runner/goal-review-fixture.test.ts evals/runner/review-outcome-eval-checks.test.ts evals/runner/review-route-eval-checks.test.ts: 109 passed, including all eight repair fixture setups.
• All deterministic plugin tests now run in pytest, including public CLI exit codes, exact report output, immutable finding bindings, provider refusals, and command execution from paths containing shell metacharacters. The shared TypeScript eval-runner tests remain in TypeScript.
• uv run --quiet --frozen --no-dev --project plugins/capability/darrow-review/backend python plugins/capability/darrow-review/backend/tests/fresh_install.py: all seven copied-plugin entrypoints passed on macOS with mocked provider transcripts. Final CI passed the Python 3.10–3.13 matrix and fresh copied installs on Linux, macOS, and native Windows.
• Live Codex reviewer-route-override and fix-verification-resolved: each passed N=1. All 30 review cases prepared in the final dry run; this is fixture validation, not 30 live passes.
• Live Claude reviewer-route-override: failed N=1 by returning a short finding without scope/route/report artifacts. A separate HEAD-baseline plugin trial reproduced the same omission; no Claude live-pass claim is made.
• bun run lint, bun run lint:ts, bun run lint:shell, bun run typecheck, bun run check:decisions, bun run check:docs, and the skill inspector passed. Independent artifact validation and the shell-to-Python coverage comparison findings were fixed and covered by regression tests.

Review notes

Requires UV and Python 3.10–3.13; obsolete bin/ paths are removed, so external callers must use the documented frozen package entrypoints. Review the native Windows job-object ownership and immutable original/prior/current repair binding most closely. The existing Claude live-eval omission remains a documented limitation outside this mechanics migration.

Checklist

• I have read and followed CONTRIBUTING.md, including the contribution
  licensing terms.
• I added or updated the applicable invariant before implementation, or
  this change does not affect a capability invariant.
• I added or updated colocated evals, or this change does not affect skill
  behavior.
• I confirmed that each changed plugin remains self-contained, or this
  change does not affect plugin content.
• I ran bun run check:python, or this change does not affect registered
  Python packages or their repository quality infrastructure.