feat(web): flag reviewed files for follow-up and block staging until cleared

[MTVaught]

Problem

While reviewing in the diff panel, a file that still needs more work or a comment had no state of its own. Collapsing it was the only signal, and a misclick on a collapsed header could stage it anyway. Git cannot hold "not done yet", so the flag needs a home of its own.

Fix

A per-file follow-up flag stored on the thread as orchestration events, so it syncs to every client, survives reloads, and is deleted with the thread.

• thread.review-file.flag / thread.review-file.unflag commands and matching events. The decider resolves unflag to the paths actually flagged, and unflag without paths clears them all. Re-flagging and no-op unflags re-emit without touching updatedAt.
• reviewFollowUpPaths on the thread read model, projected in memory and into a new review_follow_up_paths_json column (migration 053). Thread shells are unchanged.
• The diff panel shows a Follow-up badge and a flag toggle in each file header and in the navigation row for the active file. A flagged file's Stage button is disabled with a tooltip, and Stage all skips flagged files. Unstage stays available, collapsed or not.
• A stacked git action that creates a commit clears the flags for the paths it committed, or all of them when it committed the whole working tree.
• Server capability threadReviewFlags so clients can detect support.

Mobile decodes the new field but shows no badge or control yet.

Tests

• Decider: flag, idempotent re-flag, targeted unflag, unflag-all, no-op unflag.
• Projector and client reducer: accumulate and clear.
• Migration 053: column added and rerun-safe.
• Existing projector and snapshot query expectations updated for the new field.

Follow-up to #100.

Built with Claude Fable 5.1 via Claude Code in T3 Code.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.6 KiB	+15 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+19 B (+0.3%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−4 B (−0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.6 KiB	+44 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	+15 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.5 KiB	+29 B (+0.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	57.8 KiB	+44 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: 2f26026 · PR result: 5605b57 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 114.0 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.