Craft PR review workflow: subagent self-review + bot-finding loop before merge

Before merging non-trivial Craft PRs: (1) dispatch a subagent for objective critical review — it catches silent-corruption bugs human review glosses over (e.g. regex boundary issues); (2) verify each finding with a minimal reproducer before fixing; (3) add regression tests and verify they fail when the fix is reverted; (4) after push, wait for Cursor Bugbot and Seer Code Review checks (both appear as CheckRuns on the PR) — NEUTRAL conclusion means non-blocking findings posted as review comments; (5) reply to each bot comment via gh api repos/.../pulls/comments/{id}/replies and resolve threads via GraphQL resolveReviewThread. Branch protection requires review approval; repo admins can use gh pr merge --squash --admin to bypass for self-reviewed fixes. Format check (prettier) is part of the Lint workflow — run pnpm format before pushing.