Read per-repository settings from .github/code-review/ on the default branch #43

Background. Each repository needs a place for its own review settings that the template never renders (so Copier never deletes it) and that is always read from the default branch, so a PR can't soften its own review:

• .github/code-review/config.yml:
  • sensitive: path globs (Deep reviews for sensitive paths, and a light path for documentation-only pull requests #42)
  • skip: path globs never reviewed (e.g. vendored code)
  • policies: documents every reviewer gets as conventions (e.g. Identity's docs/api-compatibility.md, 5.6 KB, read by no reviewer today)
  • optional tiers: overrides
• .github/code-review/guidance.md: project rules, written by hand or by /review teach (/review teach: turn a correction into lasting guidance #45). They join the context stage's catalog like .github/instructions rules.
• .github/code-review/reviewers/*.md: project-only charters, same format as reviewers/*.md in the engine. For example, an OAuth/OIDC/JOSE conformance reviewer for Identity. The selection model may add them; a paths: frontmatter adds one to the floor.

Current state. src/gather.ts reads only AGENTS.md sections and .github/instructions/*.instructions.md from base. No repository has .github/code-review/ (Identity returns 404).

What to do.

1. In gather(), read the three sources from basePath only, never prPath. Validate config.yml with a small schema. An invalid file gives a warning in the check run and defaults, not a failed run.
2. policies: files are appended to conventions with their path, within maxConventionChars (raise it, or give policies their own budget).
3. skip: files are listed as "skipped by config" in the check run, never silently dropped.
4. Project charters are loaded alongside loadCharters(root), prefixed project:; an engine charter of the same name is not overridden.
5. Document the folder in the README, with an Identity example.

Acceptance.

• A unit test with a fixture base showing that each setting takes effect.
• A PR that edits .github/code-review/config.yml is reviewed with the default branch's copy (test with differing base and head copies).
• Identity can add policies: [docs/api-compatibility.md], and the api-compat reviewer's prompt contains it (visible in the trace).

Filed from the 2026-10-31 audit of the NCodeGroup review-bot and project-template design against what was built. This issue stands alone: everything needed to do it is above.