feat(review): --export-tribunal-ledger flag

[dpdanpittman]

Summary

Add a `--export-tribunal-ledger ` flag to `clawpatch review` that emits a single JSONL file at the end of the run, with one line per finding shaped for downstream Tribunal-style signed-ledger ingest.

Why

Some downstream consumers ingest clawpatch findings into a separate signed ledger (Tribunal does this, but the shape is generic). Today they read `.clawpatch/findings/.json` one file per finding after the review completes — for 100+ findings on a large repo that's measurable I/O. This flag skips the per-file round-trip and emits the data shaped for direct ingest.

Schema

Each JSONL line:

```json
{
"kind": "clawpatch-review",
"finding_id": "fnd_...",
"plan_id": null,
"round": 1,
"agent_pubkey": null,
"agent_label": "clawpatch-",
"severity": "critical|high|medium|low",
"category": "bug|security|...",
"claim_hash": "<finding.signature>",
"claim_uri": null,
"stake": null,
"timestamp": "<finding.updatedAt>",
"signature": null,
"run_id": ""
}
```

The schema is documented inline at the helper so future readers don't have to chase the spec.

Behavior

• Flag omitted: nothing is written. The review result object does not contain an `exportTribunalLedger` key (omitted via conditional spread, so existing consumers see the same shape).
• Flag provided: file is written once via `writeFile`, path resolved against cwd, included in the review result as `exportTribunalLedger`. Empty findings → zero-byte file.
• Flag with empty string: rejected with exit 2 / `invalid-usage`.

Tests

Three new cases in `workflow.test.ts`:

1. `writes a tribunal-shaped JSONL ledger when --export-tribunal-ledger is set` — end-to-end review with the mock provider; verifies the file exists, parses, and matches the documented shape.
2. `omits exportTribunalLedger from the result when the flag is absent` — verifies the result key is not present when the flag is omitted.
3. `parses --export-tribunal-ledger as a review value flag` — argv parsing.

Full suite: 463 passing locally.

Notes

• Opt-in only. No behavior change for any existing user.
• Schema is documented inline at the helper.
• Composes cleanly with all other review flags.
• Independent of feat(review): --prompt-file flag #64 (`--prompt-file`); both can land in either order.