fix(review-suite): detect nested finding-verifier faults; harden render/fault markers

code-reviewer verdict.py: finding-verifier now completes "successfully"
with fault markers INSIDE its FINDING_VERIFIER_RESULTS payload
(parse_fault's `pipeline-fault` sentinel id, verify_fault / verdict_gate
crash-guard notes prefixed PIPELINE-FAULT:), which the old
"Agent node failed:" prefix check never saw — a dead parse degraded
silently to "unverified" with no fault recorded. Detect them, anchored on
the sentinel id / note prefix only (never a substring over the report),
counted over the raw entry list so duplicate crash-guard ids are not
collapsed. Faults lead the attention list uncapped; the display cap of 5
applies to non-fault entries; the "always-human trigger(s) fired" reason
fires only when non-fault triggers exist.

code-reviewer render.py: CONTRACT comments at the verdict and summary
lines review-gauntlet's gate parses; every LLM-influenced value rendered
after the summary line (dropped_titles, rigor, bar_provenance,
resolved_surfaces, reason) is newline-sanitised so none can forge a
second summary line.

finding-verifier verdict_gate.py: the outer crash-guard note carries the
PIPELINE-FAULT: prefix (the after-retry UNVERIFIABLE path stays
unprefixed — model misbehaviour, not infrastructure); README names all
three emitters.

deep-research: vet_fault's UNVETTED note tells the critic not to request
revision solely because the assessment is unavailable (it matched
critique's PREPRINT/UNVERIFIED REVISE trigger verbatim, burning the
revision budget on an infra fault); vet_fault and critique_fault dedupe
repeated faults and preserve accumulated faults on crash via
safe_faults(); question_fault keeps its plan-pinned prefix and appends the
lane's question identity so distinct dead lanes no longer collapse in
combine_findings' dedupe.

assets/agents/finding-verifier/README.md

@@ -46,9 +46,10 @@ flowchart TD
    contract (VERIFIED = keep + paste evidence; FALSE = drop + tally; UNVERIFIABLE = keep,
    marked). No final LLM step that could editorialize.
 
-The dashed edges are fault paths. Both fault markers surface as `PIPELINE-FAULT:` text in
-a verdict's `note`, and a fault can only ever produce UNVERIFIABLE — degraded output is
-never a passing verdict. Every path ends at `done`, so the `FINDING_VERIFIER_RESULTS`
+The dashed edges are fault paths. All three fault emitters (`parse_fault`, `verify_fault`,
+and `verdict_gate`'s own crash guard) surface as `PIPELINE-FAULT:` text in a verdict's
+`note`, and a fault can only ever produce UNVERIFIABLE — degraded output is never a
+passing verdict. Every path ends at `done`, so the `FINDING_VERIFIER_RESULTS`
 sentinel is always emitted and the caller's verify lane degrades instead of dying.
 
 ## What it is NOT

assets/agents/finding-verifier/scripts/verdict_gate.py

@@ -104,6 +104,7 @@ def main():
         )
         return
 
+    # Deliberately not PIPELINE-FAULT-prefixed: model misbehavior, not infrastructure.
     print(
         json.dumps(
             {
@@ -128,7 +129,7 @@ except Exception as e:  # noqa: BLE001 — the gate must never crash the chain
                     "id": "unknown",
                     "verdict": "UNVERIFIABLE",
                     "evidence": "",
-                    "note": f"verdict gate error: {e}",
+                    "note": f"PIPELINE-FAULT: verdict gate error: {e}",
                 }
             }
         )