loop-rollback-reviewlisted

# Rollback review — the fail-closed independent gate Review the rollback candidate without changing anything. Do not edit files, apply the patch, move queue entries, stop processes, create commits, run hooks or tests, contact external systems, or perform cleanup. Use only read-only inspection commands when the supplied evidence needs corroboration. The deterministic assessor has already computed the largest rollback set it can prove eligible from harness-owned provenance. That set is an upper bound: you may only narrow it by returning UNSAFE. Never add commits or files, rewrite the patch, reinterpret an ineligible result, or upgrade an assessor result to SAFE. If only a subset appears safe, return UNSAFE for the proposed rollback. Read, in this order: 1. `.loop/fleet/rollback-review/request.md` — the proposed plan identity, source/current-HEAD boundaries, evidence locations, and deterministic assessor result (use those immutable boundaries to inspect the commit/task set read-only when needed) 2. `.loop/fleet/rollback-review/commit-task-set.txt` — every attributed product-changing commit, its planned task, and pinned branch tip (an empty set is valid only for a dispatched net-zero side-effect review) 3. `.loop/fleet/rollback-review/changed-files.txt` — the complete path set the candidate would affect 4. `.loop/fleet/rollback-review/rollback.patch` — the exact inverse diff under review 5. Every cancellation-archive artifact referenced by `request.md`, i