feat: add workflow-load session boundary proof (Closes #403)

Extend the review workflow load gate with pre-review command classification,
boundary violation tracking, and structured helper-result requirements in
final reports. Adds gitea_record_pre_review_command MCP tool.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

gitea_mcp_server.py

@@ -536,6 +536,7 @@ import role_session_router  # noqa: E402
 import role_namespace_gate  # noqa: E402
 import task_capability_map  # noqa: E402
 import review_proofs  # noqa: E402
+import review_workflow_boundary  # noqa: E402
 import review_workflow_load  # noqa: E402
 import agent_temp_artifacts
 import issue_lock_worktree  # noqa: E402
@@ -5912,14 +5913,42 @@ def gitea_get_runtime_context(
     return result
 
 
+@mcp.tool()
+def gitea_record_pre_review_command(
+    command: str,
+    cwd: str | None = None,
+    classification: str | None = None,
+) -> dict:
+    """Classify and record a command executed before workflow load (#403).
+
+    Read-only with respect to Gitea API. Pre-review inventory/diagnostic commands
+    may be recorded as allowed; boundary violations block reviewer mutations.
+    """
+    recorded = review_workflow_boundary.record_pre_review_command(
+        command,
+        cwd=cwd,
+        project_root=PROJECT_ROOT,
+        classification=classification,
+    )
+    boundary_state = review_workflow_boundary.assess_boundary_status(PROJECT_ROOT)
+    return {
+        "success": True,
+        "recorded": recorded,
+        "boundary_status": boundary_state.get("boundary_status"),
+        "boundary_clean": boundary_state.get("boundary_clean"),
+        "reasons": list(boundary_state.get("reasons") or []),
+    }
+
+
 @mcp.tool()
 def gitea_load_review_workflow(
     prompt_text: str | None = None,
 ) -> dict:
-    """Load and record canonical review-merge workflow proof for this session (#389).
+    """Load and record canonical review-merge workflow proof for this session (#389, #403).
 
     Read-only with respect to Gitea API; records in-process workflow source/hash
-    proof required before reviewer review or merge mutations.
+    proof and session boundary state required before reviewer review or merge
+    mutations.
     """
     try:
         recorded = review_workflow_load.record_review_workflow_load(
@@ -5931,8 +5960,11 @@ def gitea_load_review_workflow(
             "reasons": [str(exc)],
             "recovery_handoff": review_workflow_load.recovery_handoff_without_replay(),
         }
+    boundary_reasons = review_workflow_boundary.boundary_blockers(PROJECT_ROOT)
+    helper = review_workflow_boundary.workflow_load_helper_result(
+        recorded, PROJECT_ROOT)
     return {
-        "success": True,
+        "success": not boundary_reasons,
         "loaded": True,
         "workflow_source": recorded["workflow_source"],
         "task_mode": recorded["task_mode"],
@@ -5944,7 +5976,14 @@ def gitea_load_review_workflow(
             "prompt_conflicts_with_workflow"],
         "prompt_conflict_reasons": recorded.get("prompt_conflict_reasons") or [],
         "workflow_load_proof_present": True,
-        "reasons": [],
+        "boundary_status": recorded.get("boundary_status"),
+        "boundary_clean": recorded.get("boundary_clean"),
+        "workflow_load_helper_result": helper,
+        "reasons": boundary_reasons,
+        "recovery_handoff": (
+            review_workflow_load.recovery_handoff_without_replay()
+            if boundary_reasons else []
+        ),
     }