test(review): add the fanout reviewer-diversity eval wiring and its four reused-scaffold cases #12139

Parent #7584's done-when reads "The fanout eval slice carries a Probe result: comment before the act-on cap merges", and its decisions say the reviewer-diversity eval "(12 diffs, 4 arms, 3 runs) settles the lens default, panel placement and the act-on cap" (Q134, Q160, D101). The owner approved the Q160 eval as recommended on 2026-10-15 (poteto-review decision row 99). This slice adds the arm wiring, the graders and the first four of the 12 fixtures; two later slices of #7584 add the four new defect fixtures and the four decoys in the same shape, and a host-run slice runs them, because the issue lane cannot run claude plugin eval. The design below is the approved Q160 text. On main, /review:fanout run-everything spreads by fanout_diversity: lens, the default, runs one reviewer agent per concern, and model sends one prompt per fan-out model tier (plugins/review/skills/fanout/SKILL.md "Arguments", plugins/review/reference/config.md:13). The only cross-vendor reviewer is the Codex orchestrator surface.

Done when

• plugins/review/evals/ gains fanout-diversity-* cases over four fixtures that reuse the scaffolds of guard-removal-null-user, guard-removal-empty-ratings, guard-removal-short-title and qg-security-search-sqli, with the prompt changed to /review:fanout run-everything.
• plugins/review/evals/fanout-diversity.md states, for the later slices to follow: the case directory pattern fanout-diversity-<fixture>-<arm> (arm one of l, m, mx, lx, one case directory per arm, since a case carries one prompt, one plugins list and one committed review.yaml); the ground-truth file's name and fields; the three grader file names; and a template for each grader, in which only the planted-defect text taken from the ground-truth file varies between fixtures (type: llm graders take criteria and focus, so the defect is written into the criteria). The arm-check regex grader is byte-identical across fixtures of one arm.
• Each fixture has a ground-truth file that names its one planted defect and that defect's axis (spec when the change fails its stated purpose, else standards), or none for a decoy.
• Every fixture can run under each of the four arms: lens (L), model (M), model plus Codex (M+X) and lens plus Codex (L+X).
  • Each arm's scaffold commits docs/conventions/review.yaml with that arm's fanout_diversity on the base branch, so the reviewed diff never edits it.
  • The M arms list the multi-agent plugin beside review in the case's plugins list.
  • The X arms name the Codex surface in the prompt.
• Each case has three graders:
  • a regex grader on the report's fanout_diversity: line and ## Surfaces section, which checks that the run used its arm (fanout_diversity: model for M arms, the Codex surface listed for X arms), so a run that fell back counts as invalid;
  • a type: llm recall grader on the persisted findings file, which passes when the file names the planted defect at medium severity or higher, judged against the ground-truth file;
  • a type: llm false-positive grader, which counts high or critical findings the ground truth marks wrong.
• Each grader has a samples/<grader>.json with at least one pass and one fail entry, in the shape of guard-removal-null-user/samples/.
• Each case uses schema_version: "1.1" in case.yaml and sets runs: 3 in prompt.md frontmatter, as guard-removal-null-user does.
• The diff edits no file under plugins/review/skills/ and no file under plugins/review/agents/.
• A .changes/review/*.md fragment with bump: none describes the cases.
• The PR's CI is green.

Out of scope

• The new defect fixtures and the decoys (later slices of review: spec-first fanout and ratchet move to toolchain #7584).
• Running the eval.
• Changing the fanout_diversity default, adding Codex to the default sweep, or setting an act-on cap.

Parent: #7584