feat(analysis): integrate native learning review into standard reports

[U1oSun]

Summary

Integrate the native Learning Capture review pipeline into the standard report chain so regular Task Episodes surface confirmed learning candidates in learningCaptureDiagnostics.

Task Episodes now emit bounded, privacy-safe native learning review packets; lead decisions must bind to the exact packet and source digests; source apply projects only validated matches into canonical Learning Capture diagnostics and reader evidence. Adds a source-review create CLI route behind strict owner validation, with fail-closed --help handling.

This is the second half of the LC-05 slice: the candidate-mining engine (#48) was previously only exercised by tests — the standard task-loop-source analysis path still used the legacy buildLearningLoopReview(). This PR wires the new capability into the user-facing report path.

Why

Issue/Story: No linked issue; this completes roadmap item LC-05 (learning capture).

User or maintainer outcome: repeated repair behavior becomes a reviewable learning opportunity visible in ordinary reports, instead of an engine that exists only behind tests.

Traceability and Scope

• Spec/ADR: docs/specs/2026-08-02-native-learning-report-integration.md
• Acceptance criteria addressed: AC-1 through AC-5.
• Canonical owners changed: Task Episode normalization, Learning Loop candidate construction, report-source review create/apply, CLI registry, evidence brief.
• Explicit non-goals: no model auto-invocation, no automatic Rule/Skill/Memory creation, no effectiveness claim, no new detection mode, no second candidate-mining pattern.

Change Type

• Feature
• Bug fix
• Tests only
• Documentation/community
• Refactor with no intended behavior change
• Dependency, packaging, or infrastructure

Test and Review Evidence

Check	Result
node --test test/report-source-review.test.mjs	98/98 passed
learning-loop + task-loop suites	93/93 passed
node --test test/doc-link-graph.test.mjs	6/6 passed
npm run pack:verify	Passed; 450 npm entries and 472 runtime ZIP entries
npm test	1266 passed, 0 failed, 1 skipped (existing Windows symlink case outside changed modules)
git diff --check	Passed
Independent counterexample review	No remaining P1/P2 findings after two revision rounds
Manual or visual evidence	Not applicable; no UI surface

Risk and Recovery

Compatibility and cross-platform impact: zero-candidate output is byte-identical to previous behavior; provider/legacy flat learning signals remain supported; missing booleans retain unavailable/false/true semantics. Uses platform-neutral Node.js APIs.

Package, plugin, schema, or generated-file impact: Learning Loop and report-source modules are verified in both the npm package and runtime ZIP; the generated doc-link graph changed only by the new spec and reference pages.

Rollback or recovery path: revert commit ccbf03986861388480e97f2502194130ea13851f.

Residual risk or unverified boundary: one symlink-dependent full-suite case cannot run under the current Windows account; native review is deliberately limited to the recurring-correction pipeline.

AI Involvement

Level: Assisted.

Human review and validation: automated evidence and two independent counterexample-review rounds are complete.

Checklist

• I followed AGENTS.md, CONTRIBUTING.md, and the relevant canonical-owner guidance.
• The change is focused and does not include unrelated local or generated state.
• Tests and documentation match the behavior actually delivered.
• Markdown links were checked when documentation moved or changed.
• Cross-platform behavior was considered for Windows, macOS, and Linux.
• Package/runtime verification was run when shipped files or dependencies changed.
• User-facing or compatibility changes are recorded in CHANGELOG.md.
• I have the right to contribute this work under the repository's MIT License.

🤖 Generated with Claude Code