fix(panel-review): orchestrator self-arbitrates and emits in skill contract

.apm/skills/apm-review-panel/SKILL.md

@@ -184,12 +184,16 @@ the final step.
    - No persona return is missing or empty.
    If any check fails, re-invoke the missing persona and repeat the
    gate. Do not proceed to step 5 until the gate passes.
-5. Run the CEO arbitration pass over the collected findings. CEO
-   arbitration may run only after the completeness gate has passed.
+5. Run the CEO arbitration pass over the collected findings **as
+   yourself** (the orchestrator). Do NOT dispatch a separate sub-agent
+   for arbitration -- you are the arbiter. CEO arbitration may run
+   only after the completeness gate has passed.
 6. Now (and only now) load `assets/verdict-template.md` and fill it
    in with the collected findings + arbitration.
 7. Emit the filled template as exactly ONE comment via the workflow's
-   `safe-outputs.add-comment` channel.
+   `safe-outputs.add-comment` channel. You (the orchestrator) write
+   the comment; never delegate emission to a sub-agent and never call
+   the GitHub API directly.
 
 ### Dispatch contract
 
@@ -217,8 +221,9 @@ panel review that lands as one cohesive verdict and one that fragments
 into per-persona noise.
 
 - Produce **exactly one** comment per panel run. The
-  `safe-outputs.add-comment.max: 1` cap in the workflow is a backstop;
-  the discipline lives here.
+  `safe-outputs.add-comment.max` cap in the workflow is a fail-soft
+  ceiling (currently 7, one per persona slot); the one-comment
+  discipline lives here.
 - Use `assets/verdict-template.md` as the comment body. Keep its
   section headings exactly as written. Adapt the body of each section
   to the PR. Do not invent new top-level sections or drop existing

.github/skills/apm-review-panel/SKILL.md

@@ -184,12 +184,16 @@ the final step.
    - No persona return is missing or empty.
    If any check fails, re-invoke the missing persona and repeat the
    gate. Do not proceed to step 5 until the gate passes.
-5. Run the CEO arbitration pass over the collected findings. CEO
-   arbitration may run only after the completeness gate has passed.
+5. Run the CEO arbitration pass over the collected findings **as
+   yourself** (the orchestrator). Do NOT dispatch a separate sub-agent
+   for arbitration -- you are the arbiter. CEO arbitration may run
+   only after the completeness gate has passed.
 6. Now (and only now) load `assets/verdict-template.md` and fill it
    in with the collected findings + arbitration.
 7. Emit the filled template as exactly ONE comment via the workflow's
-   `safe-outputs.add-comment` channel.
+   `safe-outputs.add-comment` channel. You (the orchestrator) write
+   the comment; never delegate emission to a sub-agent and never call
+   the GitHub API directly.
 
 ### Dispatch contract
 
@@ -217,8 +221,9 @@ panel review that lands as one cohesive verdict and one that fragments
 into per-persona noise.
 
 - Produce **exactly one** comment per panel run. The
-  `safe-outputs.add-comment.max: 1` cap in the workflow is a backstop;
-  the discipline lives here.
+  `safe-outputs.add-comment.max` cap in the workflow is a fail-soft
+  ceiling (currently 7, one per persona slot); the one-comment
+  discipline lives here.
 - Use `assets/verdict-template.md` as the comment body. Keep its
   section headings exactly as written. Adapt the body of each section
   to the PR. Do not invent new top-level sections or drop existing

.github/workflows/pr-review-panel.md

@@ -117,29 +117,6 @@ gh pr diff "$PR"
 Load the **apm-review-panel** skill and follow its execution checklist
 and output contract exactly. The skill owns reviewer routing, persona
 dispatch, the Auth Expert conditional rule, the pre-arbitration
-completeness gate, template loading, and verdict shape.
-
-Auth Expert is the only conditional panelist. The skill decides
-activation from the already-fetched PR title/body/files/diff using a
-fast-path file list plus a fallback self-check. Do not invent a
-separate scope-analysis sub-agent for this. If the skill marks Auth
-Expert inactive, do not dispatch it; keep the Auth Expert heading in
-the final verdict and fill it with `Not activated -- <reason>`.
-
-## Step 3: Output contract
-
-- You may post **exactly one** comment for this entire panel run, and it
-  **must** be the final synthesized verdict from the **CEO** (after
-  arbitration). Sub-agent personas (Python Architect, CLI Logging
-  Expert, DevX UX Expert, Supply Chain Security Expert, OSS Growth
-  Hacker, Auth Expert when active) **do not** post comments — they
-  return their findings to the CEO, who synthesizes the single verdict.
-  When dispatching each sub-agent, instruct it explicitly: "do not post
-  any comment; return your findings to the orchestrator."
-- Do not call the GitHub API directly. Write the comment via the
-  provided output channel; a downstream publisher posts it.
-
-## Step 4: Emit the verdict
-
-Write the CEO's final verdict comment body to the agent output channel.
-The downstream publisher will post it to PR #$PR.
+completeness gate, CEO arbitration, template loading, verdict shape,
+and the one-comment emission contract -- including writing the final
+comment to `safe-outputs.add-comment` rather than the GitHub API.