fix(review): tolerate unescaped inner quotes in review JSON

[JohnnyVicious]

Symptom

Real user report on v1.0.10: adversarial review against a real PR came back with pretty, approve-verdict prose — but the Claude Code chat showed the raw JSON object (not the rendered markdown) and the posted PR review on GitHub was the same raw JSON embedded as a code block. Both outputs looked like garbage:

```
{
"verdict": "approve",
"summary": "Change correctly closes the silent-failure gap ... all now return explicit {"success": false, "error": "..."} instead of ...",
"findings": []
}
```

Root cause

The model's `summary` field embeds a literal `{"success": false, "error": "..."}` with unescaped inner quotes. Strict `JSON.parse` bails at the first `"success"` (it thinks the `summary` string ended early), `tryParseJson` returns null, and the companion falls through to printing the raw text.

Fix

Replace `tryParseJson` with a schema-aware `tryParseReview` (new file `plugins/opencode/scripts/lib/review-parser.mjs`) that:

1. Fast path: strict `JSON.parse` with ```json fence stripping. Same behavior as before for well-formed reviews.
2. Lenient fallback when strict parse fails:
   • `verdict` via closed-vocabulary regex (`approve` | `needs-attention` — no nested quote risk)
   • `summary` by slicing between `"summary": "` and the `", "findings"` anchor, OR (when findings is absent) the last `"` before `}`. Anything in between is kept literally, so unescaped quotes don't derail the slice.
   • `findings` via a depth-aware bracket walker that tracks JSON string state. If the extracted array still fails to parse, return `[]` — better to show verdict + summary than nothing.

Narrowly tailored to our `{verdict, summary, findings}` schema. No general-purpose JSON repair library, no new dependencies.

Tests

• New `tests/review-parser.test.mjs` (16 cases):
  • Fast path: well-formed JSON, fenced JSON, normalization, non-review JSON, non-string input.
  • Regression pinned to the exact broken shape from the real report — verifies `JSON.parse` throws on it AND the lenient path recovers the verdict, summary (including the embedded `{"success": false, …}`), and empty findings array.
  • Malformed findings → recovered verdict + summary, empty findings array.
  • `sliceMatchingBracket` walker: nested brackets, brackets inside strings, escaped quotes, no-match, non-bracket start.
• Full suite: `npm test` → 268/268 pass.

Manual verification after merge

I'll ask the user to re-run `/opencode:adversarial-review --pr 412 --post` on the same branch and confirm both the chat output and the posted PR review render as the nice markdown.