Align python-code-reviewer skill with repo ground truth

Update the reviewer skill so its procedure matches how this repo actually works:

- Route review reports to docs/reviews/ and mark them non-canonical, resolving the conflict where reports landed in the same docs/ tree they resolve findings against.
- Pin verification commands to uv (uv run ruff check / ty check / pytest -m 'not external').
- Record the pytest contract: strict markers, strict asyncio mode, and the never-awaited-coroutine warning promoted to an error.
- Convert the deterministic checks to a table with an Enforced by column; three checks are unenforced and one only partial, which are now findings by construction.
- Add a consequence-based severity rubric and a Direction column for bidirectional drift.
- Escalate test-suite concerns to test-effectiveness-auditor.

Also fix tests/test_db.py, which was missing 'from sqlalchemy import text' while using it in 14 places. Three tests were failing with NameError. Wrapped the pre-existing long lines in the same file so it lints clean.

Document the deliberate nicegui==3.13.0 pin in pyproject.toml, a new runbook dependency upgrade policy, and the reviewer skill, so the pin is not flagged as a defect or widened as incidental cleanup.

Co-authored-by: Copilot App <[email protected]>

tests/test_db.py

@@ -6,6 +6,7 @@ import pytest
 import pytest_asyncio
 import sqlalchemy as sa
 from sqlalchemy import inspect
+from sqlalchemy import text
 from sqlalchemy.dialects import postgresql
 from sqlalchemy.exc import SAWarning
 from sqlmodel import SQLModel
@@ -144,7 +145,15 @@ async def test_create_all_declares_hot_path_indexes(tmp_path):
                 database = inspect(sync_connection)
                 indexes = {
                     table: [index["column_names"] for index in database.get_indexes(table)]
-                    for table in ("job", "source", "job_source", "document", "document_person", "document_tag", "person_tag")
+                    for table in (
+                        "job",
+                        "source",
+                        "job_source",
+                        "document",
+                        "document_person",
+                        "document_tag",
+                        "person_tag",
+                    )
                 }
                 job_source_unique = [
                     constraint["column_names"]
@@ -300,8 +309,10 @@ async def test_reconcile_canonical_media_paths_normalizes_source_and_photo_paths
             )
             await connection.execute(
                 text(
-                    'insert into "source" (id, document_id, page_number, upload_name, filename, file_path, file_hash, file_size_bytes, date_uploaded) '
-                    'values (:id, :document_id, 1, :upload_name, :filename, :file_path, :file_hash, :file_size_bytes, CURRENT_TIMESTAMP)'
+                    'insert into "source" (id, document_id, page_number, upload_name, filename, '
+                    "file_path, file_hash, file_size_bytes, date_uploaded) "
+                    "values (:id, :document_id, 1, :upload_name, :filename, :file_path, "
+                    ":file_hash, :file_size_bytes, CURRENT_TIMESTAMP)"
                 ),
                 {
                     "id": "33" * 16,