[codex] Trace supporting review files

[romgenie]

Summary

• Adds trace-backed review.supporting_files evidence for hosted headless reviews.
• Records supporting files observed through Read, Grep, and Glob telemetry, while filtering out PR-changed files already listed as reviewed_files.
• Threads adapter-provided audit_instruction into the headless review prompt so hosted reviews explicitly inspect supporting context.

Context

• Related issue/user request: Hosted Review Mode — security & memory hardening track OpenCoven/coven-code#119; stacked after PR [codex] Emit structured headless review results #7.
• Scope: crates/cli headless review result construction and prompt generation.
• Non-goals: structured finding extraction, test-result parsing, adapter contract/schema changes.

Changes

• Introduces ReviewTrace for normalizing and de-duplicating workspace-relative files from tool telemetry.
• Passes trace evidence from run_headless into headless::build_result.
• Removes the previous fixed "not trace-backed" limitation when supporting evidence is present.
• Adds tests for trace parsing, reviewed-file filtering, and trace-backed review result output.

Validation

Record exact commands and outcomes. Mark items N/A with a reason when they do not apply.

• git diff --check - passed; only line-ending warnings from Windows checkout.
• cargo fmt --all - covered by cargo fmt --manifest-path src-rust\crates\cli\Cargo.toml, passed.
• cargo check --workspace - passed from src-rust/.
• cargo clippy --workspace --all-targets -- -D warnings - passed from src-rust/.
• cargo test --workspace - passed from repo root via cargo test --manifest-path src-rust\Cargo.toml.
• Targeted/manual checks: cargo test --manifest-path src-rust\Cargo.toml -p claurst headless - passed, 21 headless tests.
• Not run: N/A.

PR Readiness

• Diff is limited to the intended files.
• Generated files were not edited by hand.
• User-facing docs/help were updated or are not needed.
• No secrets, credentials, local paths, or unrelated logs are included.
• Remaining risks or follow-up work are listed above.

Remaining risk: this proves tool-level file inspection, not semantic use of every file. A later PR can parse final review prose into structured findings/tests.

[romgenie]

@cody please review this PR.

Focus on whether the headless review result now proves supporting-code inspection. Inspect the changed files and at least one relevant supporting file beyond the PR diff before giving your final review.

[covencat]

Cody dogfood result

Status: success

Cody made 1 commit across 0 files.

Cody

Completed the requested change.

Files changed

No files changed.

Evidence

• PR: [codex] Trace supporting review files #8
• Base: codex/headless-review-contract-v2 @ 9e2e44e26a8febd17b43b471849ab97939d79907
• Head: codex/headless-review-tool-read-tracing @ 017d44e78b43e699427247252942f333de763da8
• Checked-out workspace HEAD: 017d44e78b43e699427247252942f333de763da8
• Changed files supplied to agent: 2
• Review context SHA-256: 56ddf7a789849ebe4ded34c1e8ce74126076a14c3d103c2efe85e1589f05b9ea
• Files: src-rust/crates/cli/src/headless.rs, src-rust/crates/cli/src/main.rs

Structured review

• Mode: pull_request
• Evidence status: complete
• Reviewed files: 2
• Reviewed file list: src-rust/crates/cli/src/headless.rs, src-rust/crates/cli/src/main.rs
• Supporting files inspected: 121
• Supporting file list: .github/workflows/rust-ci.yml, docs/advanced.md, docs/configuration.md, docs/headless-contract.md, docs/shared/hosted-review-phase-1-pr.md, docs/shared/hosted-review-phase-2-pr.md, docs/shared/hosted-review-phase-3-pr.md, docs/shared/hosted-review-phase-4-pr.md, docs/shared/hosted-review-phase-5-pr.md, src-rust/crates/cli/tests/headless_contract/result.example.json, src-rust/crates/cli/tests/headless_contract/result.schema.json, src-rust/crates/cli/tests/headless_contract/session-brief.example.json, src-rust/crates/cli/tests/headless_contract/session-brief.schema.json, src-rust/crates/commands/src/lib.rs, src-rust/crates/commands/src/named_commands.rs, src-rust/crates/core/src/anthropic_cli_import.rs, src-rust/crates/core/src/claudemd.rs, src-rust/crates/core/src/coven_daemon.rs, src-rust/crates/core/src/git_utils.rs, src-rust/crates/core/src/hosted_review.rs
• Supporting file list truncated after 20 entries.
• Findings: 0
• No-findings reason: The run completed review mode without returning structured findings; see pr_body for the narrative review.
• Tests reported by runtime: 0
• Limitations: 0

Files changed: 0
Commits: 1

Task 189eb9f0-78e7-11f1-9a04-6239ec1b2e9f. Publication is enabled on the hosted test adapter only.