plan: add code review remediation backlog

[davidahmann]

Problem

The code review surfaced three contract-level findings that need an execution-ready remediation plan before implementation:

• P1: fail-open org/repo acquisition can fabricate repos when GitHub API settings are unset.
• P1: regress pipeline treats policy findings as tools, causing false drift.
• P2: non-approved manual lifecycle transitions can retain approval_status=valid.

Changes

• Added /Users/davidahmann/Projects/wrkr/product/code_review.md as an adhoc backlog plan.
• Structured the plan into prioritized epics/stories with:
  • tasks, repo paths, run commands
  • mandatory test requirements
  • per-story matrix wiring
  • recommendation traceability
  • minimum-now sequencing and definition of done
• Preserved Wrkr non-negotiables (determinism, fail-closed behavior, contract stability).

Validation

• make prepush-full
• /Users/davidahmann/Projects/wrkr/.tmp/wrkr scan --path /Users/davidahmann/Projects/wrkr/scenarios/wrkr/scan-mixed-org/repos --state /Users/davidahmann/Projects/wrkr/.tmp/ship-scan-state.json --json