report-formatlisted

# Review Report Format Unified format for all review findings. Schema: `schemas/review-report.schema.json` (v3.0.0). **Hard cutover**: schema versions 1.x and 2.x are no longer accepted. Producers and consumers must use v3.0.0. ## Finding Structure Agents emit a JSON array of `finding_section` objects: ```json [ { "title": "Section Title", "category": "security|project|code_quality|call_tree|dependencies|documentation|pr_comments|pr_promises", "findings": [ { "id": "PREFIX-001", "risk": 0.6, "impact": 0.7, "scope": 1.0, "title": "Short finding title", "tags": ["A03 Injection", "CWE-79"], "location": "src/auth.rs:42-56", "description": "What the issue is and why it matters", "impact_description": "What could go wrong (Markdown narrative)", "recommendation": "How to fix it", "code_snippets": [ {"language": "rust", "caption": "auth.rs:42", "content": "let user = unwrap_token(&hdr);"} ] } ], "positives": "Optional positive observations" } ] ``` This is the producer-emitted shape. Integer `severity` and float `overall_severity` are not listed — the coordinator's derive pass adds them from `risk`/`impact`/`scope` (see "Coordinator-derived / validator-owned fields" below). The example validates against the v3 schema as-is because those derived fields are optional; producer skills can call `validate_report.py` on their own output before c