verify-closurelisted

# Verify closure of a prior audit / issue Read the [shared review contract](../../contracts/review-contract.md) before executing this workflow. Its evidence, candidate ledger, execution and verdict rules apply throughout. Unlike `review-pr`, the verdict here is **not binary** and the PRs are usually **already merged**. For each prior finding you decide: did the fix actually land, and did it break anything? Read-only throughout. ## Stage 1 — Inputs & parse Get two things from the user (ask if missing): - **Source of truth:** an issue number (`gh issue view <n>`) or a path to the audit report. - **PR range:** an explicit PR list, or "every PR since the issue was opened" (derive from dates/labels). Parse the source into a flat list of findings, each with a stable **ID** (use the original numbering, or assign `F1, F2, …`), severity, and the claimed location. This list is the closure checklist. ## Stage 2 — Per-finding verification (fan-out `Task`, host-configured models) One subagent per finding (or batched by area for very large audits). Each: 1. Find the fixing PR: `gh pr list --search "<ID or keywords> in:title,body" --state merged` and read its diff. 2. Read the **current source** at the finding's location — not just the PR diff. The fix may have been altered by later PRs. 3. Apply an **inverted adversarial** stance: *"prove the fix did NOT close this finding."* Construct the input/path that would still trigger the original problem. 4. Emit a per-finding verdict: ``` [