unic-spec-review S7: posting (--post write path) — comment write, inline-anchor-resolver, attribution footer

[orioltf]

Parent

Epic: #200 — unic-spec-review plugin.

What to build

Open the posting write path behind --post. With --post, the command can publish a selected Finding as a Confluence comment, anchored to the exact spec text where possible and falling back to a page-level comment otherwise, each carrying a visible attribution footer.

• Extend atlassian-fetch with a Confluence comment write path (inline and footer comments) via the v2 API.
• Add inline-anchor-resolver: resolves a Finding's anchor text against the fetched page body into a textSelection and matchCount for the v2 inline-comment API, or decides a page-level footer fallback when the text cannot be uniquely matched.
• Add attribution-footer: renders the visible provenance footer on every posted comment (which command authored it and the Finding's category) and recognises command-authored comments by that footer. No hidden marker.

Write-safety invariant: bare /review-spec stays strictly read-only. --post makes posting possible, never automatic. This slice may post a single confirmed Finding directly (the cancellable multi-step Approval Loop and dedup arrive in S8); the simplest safe confirmation is acceptable here, but posting must never happen without an explicit user go-ahead, and the user must be able to decline.

Acceptance criteria

• atlassian-fetch can write a Confluence comment (inline v2 textSelection/matchCount, and footer/page-level) with injected fetch.
• inline-anchor-resolver resolves anchor text to a unique textSelection+matchCount, or returns a footer-fallback decision when the match is absent or ambiguous.
• attribution-footer renders a visible footer on every posted comment and can recognise a command-authored comment by it; no hidden marker.
• Bare /review-spec (no --post) performs zero writes. With --post, a Finding is posted only after explicit user confirmation, and the user can decline (post nothing).
• node:test unit tests cover inline-anchor-resolver, attribution-footer, and the atlassian-fetch comment-write path with injected deps; no live services. The confluence-writer thin wrapper is not unit-tested.
• PR adds CHANGELOG.md bullets under [Unreleased] and bumps the patch version; verify:changelog passes. No em dash in authored text (except the mandated CHANGELOG version header).

Blocked by

• unic-spec-review S1: skeleton tracer bullet — classify one URL, fetch page, one Gaps agent, write report #202 (S1 — vendored atlassian-fetch, classifier, report).