feat(ce-code-review): emit a schema'd envelope.json in headless mode

[gushecht]

Problem

mode:headless is documented as the mode "for programmatic skill-to-skill invocation" (SKILL.md §"Headless mode rules"), but its only specified machine handoff is the prose text envelope (§"Headless output format"). Programmatic callers must parse that prose with a grammar — header sentinel, Verdict: line, [P1][gated_auto -> …] finding lines, terminator — which breaks on cosmetic drift (a preamble line, trailing text on the header, a reworded section heading).

The run-artifact directory already exists, but the structured data in it isn't a usable contract for the merged result:

• per-reviewer {reviewer}.json files are pre-merge / pre-dedup / pre-gating;
• metadata.json carries only run_id/branch/head_sha/verdict;
• the "synthesized findings" artifact (Step 4) has no documented shape.

So the post-merge, synthesized finding set — the thing a caller actually wants — is only emitted in a specified form as prose.

(Context: we consume mode:headless from a downstream CI reviewer and have repeatedly lost expensive reviews to prose-format mismatches; this is the upstream half of the fix.)

Proposal

In headless mode, additionally write a machine-readable <run-id>/envelope.json containing the merged finding set (post-Stage-5b), verdict, and counts, against a new published references/envelope-schema.json. Surface its path on a new Envelope: line in the prose output.

• Additive / non-breaking. The prose envelope is byte-identical; only new lines and files are added. It remains the primary human-facing handoff; JSON is the machine handoff.
• Low maintainer burden. The merged findings already exist in-context at Stage 5, and you already write per-reviewer JSON against findings-schema.json — this serializes data you have, it isn't a new computation. Per-finding fields are lifted 1:1 from findings-schema.json (plus a reviewers list from the merge tier), so the field mapping is mechanical.
• Self-validating. The skill validates the file against the schema before emitting Review complete; on failure it emits the existing degraded envelope rather than writing a malformed file.

Changes

• skills/ce-code-review/references/envelope-schema.json — new draft-07 schema for the merged envelope.
• skills/ce-code-review/SKILL.md — headless-mode rule, an Envelope: line + formatting note in the output format, the field mapping in Step 4, and registration in Included References.

Validation

• bun test — 1395 pass / 0 fail (unchanged from base).
• bun run scripts/release/validate.ts — metadata in sync.
• Schema is valid draft-07 and accepts a representative merged envelope.

Happy to adjust naming, schema shape, or whether this should extend to autofix/interactive modes too — wanted to keep the first cut minimal and headless-only.