feat(exec): publish authenticated review verdicts

[andrei-hasna]

Summary

• add explicit opt-in authenticated review-event delivery to Hasna Identities
• bind started and terminal events to an independently observed live GitHub/git merge candidate and acceptance scope
• preserve structured app-server review output so missing, ambiguous, stale, or P0/P1 results fail closed

Verification

• cargo metadata --format-version=1 --locked --no-deps -> exit 0
• cargo fmt -- --config imports_granularity=Item -> exit 0 (stable rustfmt ignored the nightly-only import-granularity option)
• git diff --check -> exit 0
• secrets scan staged . --json -> findingCount: 0, 16 files scanned, no skipped files
• Blacksmith Testbox compile/tests and canonical app-server schema generation are being run on this branch

Notes

• delivery is omitted by default; the existing review path remains unchanged
• reviewer credentials are accepted only from HASNA_IDENTITIES_REVIEW_API_KEY and are sent only as an Authorization header
• the Identities ingress contract is pinned locally because this producer and the receiving package are bootstrapping together

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}