feat: add /fix workflow — iterative review → fix → re-review loop (v2)

[PureWeen]

Summary

Rebased clean version of #640. Adds a new gh-aw workflow that implements an iterative review → fix → re-review loop, triggered via the /fix slash command on any PR.

How It Works

/fix on a PR
  ↓
┌─────────────────────────────────┐
│  Round 1: 3-model review        │
│  (Opus + Sonnet + Codex)        │
│  → Adversarial consensus        │
│  → Findings? YES → fix, commit  │
│              NO  → done ✅       │
└────────────┬────────────────────┘
             ↓
┌─────────────────────────────────┐
│  Round 2: Re-review fix commits │
│  → New findings? YES → fix      │
│                  NO  → done ✅   │
└────────────┬────────────────────┘
             ↓
        (up to 3 rounds)
             ↓
┌─────────────────────────────────┐
│  Push all commits at once       │
│  Post summary + final review    │
└─────────────────────────────────┘

All 9 Review Findings from #640 Addressed

#	Severity	Finding	Fix
1	🔴 CRITICAL	workflow_dispatch had no PR checkout	Added steps: block for manual dispatch
2	🟡 MODERATE	Concurrency groups not shared with review workflows	Added matching review-<PR> groups to review.agent.md and review-on-open.agent.md
3	🟡 MODERATE	add-comment missing target: "*"	Added to fix-shared.md
4	🟡 MODERATE	dotnet test --no-restore fails in fresh workspace	Removed --no-restore, added security note about sandboxed builds
5	🟢 MINOR	Round counter ambiguity	Explicit fix_round_count variable with clear increment/check
6	🟢 MINOR	Re-review diff includes unrelated changes	Scoped to git diff <baseline_sha>..HEAD (only fix commits)
7	🟢 MINOR	Inline comment validation underspecified	Aligned with review-shared.md path/line validation pattern
8	🟢 MINOR	cancel-in-progress risk undocumented	Added Rule #10 documenting the behavior
9	🟢 MINOR	allowed-events platform gap	Documented as known limitation

Additional Improvements over #640

• Uses MCP tools (get_pull_request, list_pull_request_files) instead of gh CLI (credentials are scrubbed in agent container)
• Added noop safe-output for clean PRs (Step 4d)
• Explicit PolyPilot identity in sub-agent prompts

Files

File	Purpose
.github/workflows/fix.agent.md	Slash command entry point (/fix)
.github/workflows/shared/fix-shared.md	Shared orchestration logic
.github/workflows/verify-build.yml	Cross-platform build verification
.github/workflows/review-retro.agent.md	Post-merge review retrospective

Supersedes #640.