refactor(ship): ChatGPT verifies Fable's own findings, no Sonnet pass

[BorisTyshkevich]

What & why

The --planner chatgpt plan-author loop (skills/ship/references/chatgpt-plan-author-loop.workflow.mjs) fanned out a parallel Sonnet read-only verifier per Fable finding before folding accepted ones into a revision context for ChatGPT — mirroring the default (Fable-authors) loop's pattern, where that separate fact-check makes sense because Fable there is reviewing ChatGPT's own PR/plan work.

But in this loop ChatGPT is the plan's sole author and reviser, and it already performs exactly this kind of live verification unprompted (observed live while running /ship 585 --planner chatgpt: it looked up the exact current npm package version while incorporating a finding about it). Fable's raw findings — explicitly labelled unverified, since Fable is read-only and cannot confirm exact repository/registry state — now go straight to ChatGPT's revision context instead. ChatGPT verifies each one itself before folding it in, and records anything it rejects under a ## Review responses section in the plan the same way the default loop's revise agent already does, so nothing is silently dropped even though there's no separate accepted/rejected return value anymore.

Removes one Sonnet agent call per finding per pass. Updates review-loops.md and SKILL.md, which documented the removed pattern as a hard rule ("neither ChatGPT nor Fable is a source of truth" / "the workflows return accepted and rejected lists") — both now describe the ownership-based split: whichever party owns the plan/PR being revised verifies findings against it, never the critic who raised them.

skills/ship/tests/*.test.mjs (plain node --test) is green: 5/5.

Checklist

• Tests added/updated in the same change as the code (this skill's own node --test suite — N/A to product vitest gate)
• npm test (product coverage gate) — N/A, this only touches skills/ship/
• npm run build — N/A, same reason
• Layers (src/core/src/net/src/ui) — N/A, same reason
• No new runtime dependency
• README/CHANGELOG — N/A, tooling-only change, no deployed-product behavior change
• Reconciled tracked work — N/A, no roadmap/issue link