fix(pairing-self-review): require dependency evidence

[AlejandroMorgante]

Summary

• Port the dependency-evidence gate from pr-management-code-review into
  pairing-self-review, including complete constraint-ledger and
  project-policy requirements.
• Add six project-agnostic behavioral evals covering transitive constraints,
  concrete incompatible resolutions, release policy, partial metadata,
  environment markers, and empty intersections.
• Sync the Pairing mode specification with the new self-review contract.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• prek run --all-files passes
• For Python packages touched: uv run pytest / ruff check / mypy passes
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
  (PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner --cli "codex exec --sandbox read-only --ephemeral --color never -" --grader-cli "codex exec --sandbox read-only --ephemeral --color never -" --timeout 300 tools/skill-evals/evals/pairing-self-review/ — 17/17)
• For skill behaviour changes: a new or updated eval fixture is included in this PR
  (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
• Other: fixture-only eval runner completed successfully without a model CLI

RFC-AI-0004 compliance

• HITL — any new mutation is gated on explicit user confirmation
• Sandbox — no new unrestricted host access; network reach declared in the adapter
• Vendor neutrality — placeholders (<PROJECT>, <tracker>, <upstream>, <security-list>) used in all skill / tool prose (the check-placeholders prek hook is the mechanical gate)
• Conversational + correctable — agentic-override path documented if behaviour is adopter-tunable
• Write-access discipline — no autonomous outbound messages; drafts only, sent on confirmation
• Privacy LLM — private content does not reach a non-approved LLM; redactor invoked where needed

Linked issues

None.

Notes for reviewers (optional)

The dependency scenarios mirror the maintainer review flow using synthetic
package names and fixture-local policies. No adopter-specific dependency or
release convention is made a framework default.

Generative AI disclosure

This PR was prepared with AI assistance and reviewed against the existing
maintainer-review contract, the behavioral eval suite, and the repository
validation commands. The commit carries the required
Generated-by: Codex (GPT-5) trailer.