[EmersonBraun]

What

• add a deterministic, provider-free campaign preflight command driven by one validated config
• classify every discovered open PR and report eligibility, blockers, coverage, budget, and worktree permission
• validate Codex authentication without a model request and fail closed before model/worktree execution
• share the exact review-policy fingerprint with the existing review command

Why

The hourly/three-hourly Orca campaign must discover all blockers in one cheap sweep and must never spend model calls or create worktrees before a PR is eligible and fully preflighted.

Validation

• formal harness: ak-verify run 1788924703076-14079 — COMPLETE
• full test suite: 170/170 passed
• focused final suite: 47/47 passed
• read-only AgentsKitOS campaign: 9 PRs classified, 0 model calls, 0 worktrees; six individually ready and three deterministically blocked by budget/coverage

Closes #146
Part of #137

[EmersonBraun]

Code review

No issues found after the multi-agent review and remediation pass. Checked for bugs, campaign fail-closed behavior, provider-free execution, repository instructions, and current-source verification.