feat(web): combine pull request comment and review composer

[rynfar]

The pull request detail panel currently has separate floating controls for a general comment and a Code-tab review. This combines them into one composer with Comment and Review modes. Pending line comments or a started review summary open the Review mode; both drafts stay mounted while switching modes or closing the popover. The available controls remain the intersection of host capabilities and viewer permissions, including Forgejo's required summary for requesting changes.

The adaptation preserves the current Code-tab viewed-file headers and diff layout while removing only its old review overlay. Review drafts now include the selected environment in their in-memory key alongside project, host, repository, and PR number, so two environments cannot show each other's pending review. The trigger does not advertise review when verdict permission disappears. Existing comment submission, close/reopen-with-comment, and failure retry behavior are retained.

This branch has exact pending UI prerequisites #815 (5cc7cb3ae209eb8911483e634ee69102ca7e9d83) and #826 (ab1380bdd9649cf52de04773ef9695ca06300d9d) in ancestry; #815 itself includes #798/#785 and #828. Base remains pylon. Adapted upstream source: 5423ba0fd08447240282c08362ee8e382bf16903. #834/#838 are separate and are not prerequisites.

Validation: 48 focused composer/comment/detail/review-store tests, plus 138 focused combined PR-detail/viewed-file tests; web typecheck, scoped lint, formatting, and diff check passed. Independent source review passed on staged SHA256 1ca0c18f171519deca93dcbfbd37ee543d3dd2d17cea6cba1f7ccf4de0fc317d. Browser verification was not run because AGENTS.md requires explicit browser approval.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
pylon-marketing	Ignored	Preview	Sep 24, 2026 1:16pm UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.0 KiB	14.0 KiB	−20 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	+2 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.8 KiB	6.7 KiB	−22 B (−0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	14.0 KiB	14.0 KiB	−14 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	−13 B (−0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−1 B (−0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.9 KiB	58.9 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 7ed3f71 · PR result: 8e3ac2d · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.