Use strict read-only, evidence-driven audit workflows

When reviewing a candidate, preserve repository state: do not edit, format, mutate VCS, use the network, access production databases, or run unnecessary exhaustive checks. Freeze and verify the exact candidate, parent, changed files, conflicts, status, and diff hash at both the start and end. In colocated repositories, follow Jujutsu semantics and inspect jj st because conflicts may be recorded without command failure. Examine every changed line and relevant lifecycle/error/test paths. Report substantive PASS, CONCERN, or MUST-FIX findings with exact file:line evidence, concrete fixes, missing tests, compatibility implications, and residual risk. Require deterministic bug regressions that fail on the base, pass on the fix, exercise the real precondition, and fail when the guard is removed. Conclude with an explicit MERGE or DO-NOT-MERGE verdict.