ci: re-enable pr-review bot on glm-5.3-flash with recalibrated output contract

Re-enable the automated PR review (pull_request_target + /oc-review
comments) on zai-coding-plan/glm-5.3-flash via ZHIPU_API_KEY.

Recalibrate the output contract based on an audit of 69 past reviews
(22 PRs, Aug 15-18): 18 of 27 BLOCKED verdicts were template-policing,
3.1 reviews per PR, ~8.4K chars per comment.

- BLOCKED now means code/merge problems only; handoff/template gaps move
  to a separate one-line Handoff flag that never changes the verdict
- re-reviews emit deltas (verdict + what changed) instead of full
  re-emission; push-triggered re-reviews are throttled to one per 15
  minutes (manual /oc-review always runs)
- hard length budgets by change class; the applied-guidance table is
  gone (guidance is applied silently, named only when it produced a
  finding); empty evidence/security sections are omitted
- evidence demands are single-shot and escapable, never raised for
  dependency bumps, string edits, server code, or packaging
- the comment opens with a one-line maintainer verdict (merge / merge
  after X / don't merge because Y), enforced by the workflow
- triage-prs skill treats review:* labels as a pre-sort for verdict
  reviews

.agents/skills/triage-prs/SKILL.md

@@ -33,6 +33,8 @@ Execute the approved closes/comments with retries and ~1–2s spacing between ca
 
 ## Phase 3 — Verdict reviews
 
+The review bot's `review:*` labels are a pre-sort, not a verdict: `review:ready` PRs go first (the bot found no code defects — likely MERGE/MERGE-THEN-FIX), `review:blocked` ones carry a bot comment whose findings the verdict review verifies rather than rediscovers. Bot labels never replace the pr-review pass — the bot cannot judge product fit or maintainability scope.
+
 Split the clean pool smallest-first (tiny diffs are fast wins and most likely mergeable). Fan out subagents in batches of ~10 PRs each; every subagent receives the full `pr-review` skill text as its instructions plus its PR numbers, reads real diffs (`gh pr view`, `gh pr diff`) and the local checkout, and returns per-PR verdict blocks in the skill's output format.
 
 Consolidate into a single report grouped by verdict — MERGE, MERGE-THEN-FIX, PUSH-BACK (with the drafted lists), DECLINE (with the drafted close comments), plus every "needs your hands" line — and stop for approval. After approval: post/merge per verdict, and queue MERGE-THEN-FIX follow-ups as in-house work.