feat(gator): improve review output and launch compatibility

[johntmyers]

Summary

Make Gator's GitHub feedback shorter and easier for maintainers to understand while retaining structured evidence for follow-up agents. Also update the launcher and Codex harness for the canonical sandbox lifecycle from #2726, refresh-managed credential identities from #2780, and automatic cleanup of addressed Gator review threads.

Related Issue

No issue required: this is maintainer-directed maintenance of the internal Gator review and launch workflow.

Changes

• Render blocking findings with a concise, read-aloud Summary, followed by direct Fix and Verify guidance.
• Move evidence, reachability, impact, PR ownership, SHAs, patch identity, review mode, validation context, documentation status, E2E state, and other operational metadata into collapsed agent details.
• Preserve finding IDs and structured markers so Gator and implementation agents can continue parsing and reconciling feedback across review rounds.
• Teach the feedback ledger and GitHub write guard to recognize the condensed format and metadata details blocks.
• Resolve Gator-owned inline review threads after a follow-up commit demonstrably fixes the corresponding finding or a verified maintainer waives it.
• Guard thread resolution through exact ledger finding IDs and the Gator marker, refusing human-owned, ambiguous, or still-open review threads.
• Allow only the named ResolveGatorReviewThread GraphQL mutation and resolveReviewThread root field; update existing provider profiles in place so the permission reaches already-configured gateways.
• Preserve the gateway's current provider-profile resource_version during updates so optimistic-concurrency checks prevent stale launchers from overwriting newer profile changes.
• Reuse refresh-managed providers instead of attempting forbidden ordinary credential updates; --reset-refresh now removes refresh ownership before reseeding credentials.
• Split sandbox startup into persistent create/upload and a subsequent sandbox exec, matching the canonical main-process contract.
• Preserve gateway-issued stable and revisioned credential placeholders verbatim in Codex auth instead of converting them to identityless aliases.
• Bump the immutable Gator payload to version 7 and document the updated launch and test workflow.

Testing

• mise run pre-commit passes
• bash scripts/agents/gator/bin/gh_guard_test.sh
• bash scripts/agents/gator/bin/review_feedback_ledger_test.sh
• bash scripts/agents/gator/bin/resolve_gator_review_threads_test.sh
• bash scripts/agents/gator/bin/validate_review_findings_test.sh
• bash scripts/agents/runtime/harnesses/codex/exec_test.sh
• bash scripts/agents/runtime/supervisor_test.sh
• mise run test completed 1,243 Rust tests before one timing-sensitive WebSocket test timed out under load; the exact failed test passed when rerun in isolation.
• Live-replaced all seven active Gator watchers through docker-dev; each reached Ready, started Codex gpt-5.6-sol, and reported payload version 7.
• Live-validated repeated provider-profile updates using exported gateway resource versions while relaunching the watcher set.
• Verified PR 2851's Codex auth retained exact gateway placeholders and produced zero credential_unavailable binding denials after relaunch.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Related Gator skill and README documentation are updated