feat(TASK-019): code-reviewer fail-closed review pipeline

Every llm/agent stage that can die persistently now falls back to a
machine-readable PIPELINE-FAULT sentinel instead of killing the graph:

- review_domain -> branch-local domain_fault marker (banner-prefixed
  domain_report the map collects; completeness_gate precedent)
- verify -> verdict (verifier fault renders findings unverified + a
  PIPELINE-FAULT attention line)
- parse -> parse_fault -> render (complete NEEDS-HUMAN verdict_out;
  render's no-changes stub is bypassed for fault verdicts)
- refine_groups -> cover_gate (deterministic-proposal fallback absorbs
  the failure; degradation noted in groups_note)
- aux_lanes -> aux_fault -> synthesize (aux_note fault marker; visible,
  never blocking - aux is enrichment)
- synthesize -> verdict (synth_failure marker; keyed off the failure
  prefix + non-empty diff, never findings==[], so clean zero-finding
  reviews stay MERGE-READY)

verdict.py gains unified fault accounting (R2): any PIPELINE-FAULT in
domain_reports / verifier_output / state fault keys forces NEEDS-HUMAN,
prefix-anchored so a report merely quoting the marker mid-text never
trips it; old 'PIPELINE FAULT' spelling migrated. Faults are prepended
to attention so the [:5] cap can never hide one. Dedicated *_failure
state keys capture engine failure text on every fallback+output_schema
node, keeping the bundled warning baseline at zero.

15 python3-guarded R5 tests: fault paths, quoted-marker precedence,
happy-path byte-compat regression, marker normalization, crash-path
fail-closed (verdict/cover_gate/domain_fault), verifier-fault-on-empty-
diff render, and the no-changes stub regression.

assets/agents/code-reviewer/scripts/parse_fault.py

@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+"""Fail-closed marker for a dead parse stage of the code-reviewer graph.
+
+Reached ONLY via parse's `fallback:` route. parse's state_updates wrote an
+"LLM node …failed: <chain>" string into `parse_failure` before routing here;
+this node emits a complete PIPELINE-FAULT `verdict_out` and the graph jumps
+straight to render — a review that could not even parse its request never
+reads as MERGE-READY. render.py renders a PIPELINE-FAULT verdict despite the
+empty changed-file list (its "No changes to review." early return skips
+fault-reason verdicts).
+"""
+
+import json
+import os
+
+MAX_DETAIL_CHARS = 500
+
+ATTENTION_LINE = (
+    "PIPELINE-FAULT: parse failed — the review request could not be parsed; "
+    "the review did not run"
+)
+
+
+def load_state():
+    if path := os.environ.get("GRAPH_STATE_FILE"):
+        with open(path) as f:
+            return json.load(f)
+    return json.loads(os.environ.get("GRAPH_STATE", "{}"))
+
+
+def fault_verdict(detail):
+    return {
+        "verdict": "NEEDS-HUMAN",
+        "reason": f"PIPELINE-FAULT: parse failed — {detail}",
+        "counts": {},
+        "deferred_count": 0,
+        "dropped_count": 0,
+        "dropped_titles": [],
+        "attention": [ATTENTION_LINE],
+        "findings_final": [],
+    }
+
+
+def main():
+    state = load_state()
+    raw = state.get("parse_failure")
+    detail = raw.strip().replace("\n", " ") if isinstance(raw, str) else ""
+    if not detail.startswith("LLM node"):
+        detail = "the parse stage died without recording a failure detail"
+    if len(detail) > MAX_DETAIL_CHARS:
+        detail = detail[: MAX_DETAIL_CHARS - 1] + "…"
+    print(json.dumps({"verdict_out": fault_verdict(detail)}))
+
+
+try:
+    main()
+except Exception as e:  # noqa: BLE001 — the fault marker itself must never crash
+    print(json.dumps({"verdict_out": fault_verdict(f"fault-marker script error: {e}")}))