feat: require proof-backed PR review handoff claims (Closes #395)

Reviewer final reports must not claim proof-sensitive workflow steps
unless each claim carries explicit command/tool evidence or structured
MCP result metadata:

- New reviewer_proof_backed_claims.py verifier covering the five claim
  families from the issue: inventory completeness (explicit pagination
  metadata required; page-size assumptions rejected), earlier-PR skips
  (per-PR command/tool or structured mergeability/blocker evidence),
  baseline validation (worktree path, target SHA, dirty-before, exact
  command, exact result, dirty-after), master integration (exact
  merge/rebase/simulation command), and cleanup (final git worktree
  list proof).
- PROOF_PROVENANCE_CLASSES constant distinguishes command actually run,
  MCP metadata, inherited from previous blocker state, and not checked.
- Re-export from review_proofs and wire into build_final_report as a
  downgrade check with proof_backed_claims_proven/violations fields.
- New workflow section 30A documents the rule; contract test locks the
  marker and an export test locks the re-export.
- 13 tests in tests/test_reviewer_proof_backed_claims.py covering the
  required scenarios: baseline claim without command, skipped-PR claim
  without evidence, inventory-complete from page-size assumption only,
  cleanup without final worktree proof, and a fully proof-backed report
  passing.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

skills/llm-project-workflow/workflows/review-merge-pr.md

@@ -836,6 +836,37 @@ Include:
 
 If the report and actual tool/command log disagree, fix the report before final output.
 
+## 30A. Proof-backed claims rule (#395)
+
+Do not claim proof-sensitive workflow steps unless each claim is backed by
+explicit command/tool evidence in the transcript or structured MCP result
+metadata.
+
+Inventory completeness claims must include explicit pagination metadata:
+`has_more=false`, `is_final_page=true`, `inventory_complete=true`, or the
+total count. Do not claim inventory completeness from a page size assumption.
+
+Earlier-PR skip claims must include explicit command/tool proof for each
+skipped PR, or structured inventory fields proving non-mergeable or
+prior-blocked state.
+
+Baseline validation claims must include the baseline worktree path, baseline
+target SHA, baseline dirty-before status, exact baseline validation command,
+exact baseline result, and baseline dirty-after status.
+
+Review-worktree master-integration claims must include the exact
+merge/rebase/simulation command and result.
+
+Cleanup claims must include final `git worktree list` or equivalent proof
+that session-owned worktrees were removed.
+
+Every proof-sensitive claim must distinguish its provenance:
+
+* command actually run
+* MCP metadata
+* inherited from previous blocker state
+* not checked
+
 ## 31. Final report must distinguish mutation types
 
 Do not use the legacy field `Workspace mutations`.