ci: severity-classified sticky review comments

[fonkamloic]

Updates the automated review workflow:

• Findings are classified Critical / Medium / Low; per our review policy, only Critical blocks merging and Medium/Low may be tabled.
• The reviewer reads existing PR comments and threads before raising findings, and must cite line numbers when claiming control-flow gaps — prevents re-raising refuted findings across re-reviews.
• use_sticky_comment: true: re-reviews update one comment instead of stacking new ones.

Note: the review action skips on this PR itself (workflow file differs from main until merged) — that's its anti-tamper validation working as intended.