fix(review): deliver code-review findings to the Review panel

[radutopala]

A PR review run reported its findings and the Review panel stayed empty. Three defects stacked up between the agent's tool call and the ingest path — fixing any one alone would not have surfaced a comment.

1. The stream reader dropped the callbacks

collectOutput chose between following the container's logs live and reading them once at exit based on a hand-listed subset of the callbacks:

if cb.onTurn != nil || cb.onThinking != nil || cb.onToolResult != nil {

A review request sets only a tool-use callback, so it fell through to the batch read — which re-scans the logs with an empty streamCallbacks and discards everything. The findings were sitting in the stream with nothing listening.

Replaced with an exhaustive streamCallbacks.any(), so a callback can't be silently ignored by omission again. This also fixes a latent case: a request setting only OnActivity was losing stream-derived model and api_retry events for the same reason.

2. Tool inputs reached callers only as a lossy summary

extractToolUses passed summarizeToolInput's chat-facing summary, which returns "" for any tool whose schema it doesn't know — including ReportFindings. Added ToolUse.Raw, onToolUseRaw and AgentRequest.OnToolUseRaw so a caller that has to decode arguments gets the verbatim JSON, and pointed the review runner at that instead.

3. The review command forked into a silent subagent

The built-in /code-review command runs inline only when CLAUDE_CODE_REPORT_FINDINGS is set and ReportFindings is callable; otherwise it forks. A fork emits nothing on the parent stream — the run looks hung for minutes — and its findings never reach a tool call the parent can observe.

Review mode now takes ReportFindings out of the batch disallow list and passes the env through --settings rather than container env vars. Settings scopes are applied over process.env in a fixed order, so a container env var ranks below the user's settings file — which is bind-mounted into every agent container. A host CLAUDE_CODE_SUBAGENT_MODEL would otherwise overwrite ours and quietly downgrade the model; --settings lands in a scope that wins.

Verification

Reproduced against a real review run, whose ReportFindings payload is now a test fixture. Before: session ready, 0 comments. After: both findings render in the panel.

• go test ./... clean
• make coverage-check → 100.0%
• make lint → 0 issues

Tests added cover the raw channel, the streaming gate per callback, and a review-shaped request end to end. Docs now describe ReportFindings as the default reporting channel with the MCP tool as the override path for non-slash review prompts.