feat(deep-review): add scoped evidence and report surfaces

[limityan]

Summary

This PR adds the next stage of Deep Review runtime and UI support for scoped reviews. It introduces structured scope-profile and metadata-only evidence-pack handling in core, then exposes that information in the Flow Chat report and Review Team UI without treating reduced-depth reviews as full-depth coverage.

What Changed

Core Deep Review Runtime

• Added Deep Review scope-profile parsing from run manifests, with compatibility for existing manifests.
• Added metadata-only evidence-pack parsing and validation.
• Rejects evidence-pack payloads that try to include source text, full diffs, provider raw bodies, model output, or full file contents.
• Adds reduced-scope and evidence-pack reliability signals to Deep Review report metadata.
• Updates Deep Review reviewer and judge prompts so quick/default scoped reviews are described honestly and do not imply full-depth coverage.
• Adds a shared subagent_runtime::queue_timing primitive for elapsed queue timing while keeping Deep Review-specific queue policy, reasons, and reporting inside Deep Review modules.

Web UI And Report Surfaces

• Splits Review Team prompt-building and manifest helpers into focused modules for:
  • path metadata
  • manifest members
  • work packets
  • risk and scope profile handling
  • token budget summaries
  • evidence-pack formatting
  • incremental cache plan formatting
• Splits Flow Chat Deep Review launch helpers for command parsing, target resolution, prompt generation, and launch errors.
• Splits Deep Review report formatting into focused helpers for manifest sections, reliability notices, markdown export, and report sections.
• Updates the Deep Review consent/report UI to show scoped review coverage and evidence-pack metadata more explicitly.
• Adds localized copy for the new Deep Review scope, evidence, and reliability surfaces in en-US, zh-CN, and zh-TW.

Product Impact

• Quick/default Deep Review runs can now communicate reduced-depth coverage more clearly.
• Review reports distinguish full-depth review from scoped/risk-focused review.
• Evidence shared across reviewers stays metadata-only, which preserves the privacy boundary while still giving reviewers useful context.
• Report export and tool-card rendering now include clearer reliability signals for reduced scope, evidence-pack validation, and cache/retry-related state.
• Existing standard Code Review paths remain gated away from Deep Review-only manifest, cache, evidence, and queue metadata.

Risk And Guardrails

• Deep Review-only behavior remains behind explicit Deep Review context and manifest checks.
• The new shared queue timing primitive does not introduce a generic global subagent queue.
• Evidence packs intentionally avoid storing raw source, full diffs, model output, provider raw body, or full file contents.
• Reduced-depth reviews are surfaced as reduced-depth; they are not presented as full coverage.

Validation

• cargo check -p bitfun-core
• cargo test -p bitfun-core deep_review -- --nocapture
• pnpm run lint:web
• pnpm run type-check:web
• pnpm --dir src/web-ui run test:run