enhance(#3661): make the code-review hook point configurable (#4159)

* feat(#3661): make the code-review hook point configurable

Add `workflow.code_review_point` (`execute:post` default, or
`execute:wave:post`) so a multi-wave phase can run code review once per
wave instead of once at the end, scoped to what changed since the phase's
prior review.

The code-review capability now declares its step at both loop points via a
new generic `pointFrom` step field: `pointFrom` names an enum config key,
and the step is only active at its own `point` when that key resolves to
a matching value. `_resolvePointGate` (capability-activation.cts) is the
single shared implementation consumed identically by loop-resolver.cts and
capability-state.cts, and capability-validator.cjs enforces that `pointFrom`
references an enum key whose values cover the declaring step's own point.

code-review.md's manual-invocation gate now reads `workflow.code_review`
directly instead of probing registry presence at the hardcoded execute:post
point (so manual `/gsd-code-review` keeps working regardless of which
automatic point is configured), and its file-scope tiers narrow to what
changed since the phase's last review commit when one exists.

execute-phase.md's wave-post step dispatch gets a small, precedented
carve-out so the code-review skill still receives its required phase
argument when dispatched generically (caught by the isolated spec review).

Closes #3661

Emitted-Drift-Ack-Growth: code-review.md — #3661 adds a point-aware config gate check and LAST_REVIEW_COMMIT-based incremental scoping to the file-scope tiers.
Emitted-Drift-Ack-Growth: execute-phase.md — #3661 adds one carve-out sentence so the wave-post generic step dispatch passes PHASE_NUMBER to the code-review skill.

* docs: backfill changeset PR number for #3661 (#4159)

* fix: scope tests/io.test.cjs's fs.writeSync fault-injection mocks by fd

Five fault-injection mocks in the "bug #1008" describe blocks intercepted
every fs.writeSync call regardless of file descriptor, and several threw or
truncated unconditionally on the first call. This surfaced as an
intermittent macOS CI failure: node:test's own IPC channel back to the
parent process (which also goes through fs.writeSync internally) could get
a bogus injected error or truncated write if node's internal machinery
called it while one of these mocks was active, corrupting the message
frame the parent tried to deserialize ("Unable to deserialize cloned
data.", location tests/io.test.cjs:1:1, uncaughtException — a whole-file
IPC crash, not a test assertion failure).

Root cause confirmed by a working counter-example already in the same
file: the "#3912 A6" mocks gate on `fd !== 2` before any fault injection
and were never implicated. Applied the same fd-scoped pattern to the five
unscoped mocks (four output()-targeting tests gate on fd 1, one
error()-targeting test gates on fd 2), and added a regression test proving
an unrelated fd passes through untouched while the fault-injection mock is
active.

Found while verifying #3661; unrelated to that change's own diff.

---------

Co-authored-by: sim <sim@local>

src/loop-resolver.cts

@@ -43,7 +43,7 @@ const { resolveCapabilityRuntimeState } = capabilityStateModule;
 // ─── Capability-activation engine (single owner for config-key precedence) ────
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 import capabilityActivationModule = require('./capability-activation.cjs');
-const { _getNestedConfigValue, _readRawConfigKey, _resolveActivationValue, resolveConfigKey } = capabilityActivationModule;
+const { _getNestedConfigValue, _readRawConfigKey, _resolveActivationValue, _resolvePointGate, resolveConfigKey } = capabilityActivationModule;
 
 // ─── Canonical points (derived from LOOP_HOST_CONTRACT — authoritative 12) ───
 
@@ -203,11 +203,13 @@ function resolveLoopHooks(input: ResolveLoopHooksInput): ResolveLoopHooksResult
   // Helper: check activation using single-key precedence resolver (FIX 1 + FIX 3)
   function isActive(hook: RawHook): boolean {
     const when = hook['when'];
-    // No `when` → unconditional hook, always active
-    if (when === undefined || when === null) return true;
-    // FIX 3: `when` present but not a non-empty string → malformed registry data → INACTIVE
-    if (typeof when !== 'string' || when.length === 0) return false;
-    return _resolveActivationValue(when, config, cwd, registry);
+    if (when !== undefined && when !== null) {
+      // FIX 3: `when` present but not a non-empty string → malformed registry data → INACTIVE
+      if (typeof when !== 'string' || when.length === 0) return false;
+      if (!_resolveActivationValue(when, config, cwd, registry)) return false;
+    }
+    // #3661: optional point-selection gate — see capability-activation.cts.
+    return _resolvePointGate((hook as Record<string, unknown>)['pointFrom'], point, config, cwd, registry);
   }
 
   function isCapabilityActive(capId: string): boolean {
@@ -630,6 +632,10 @@ export = {
   // Re-exported for identity parity guard (FIX 2: resolveConfigValues in this module
   // calls resolveConfigKey; exporting it here makes the single-owner contract testable).
   resolveConfigKey,
+  // #3661: re-exported for the same identity parity guard — isActive calls
+  // _resolvePointGate; exporting it here makes the single-owner contract testable
+  // (see tests/capability-precedence-parity.test.cjs's identity guard describe block).
+  _resolvePointGate,
   CANONICAL_POINTS_FALLBACK,
   CANONICAL_POINTS,
 };