docs: add stateless-validator review checks to REVIEW.md

[vincent-k2026]

Supplements the baseline rubric with stateless-validator-specific checks it doesn't cover:

• Fail closed on the terminal publish — a permanently failed final step surfaces a non-zero exit / Err, not silent success.
• Validate config at the boundary — reject/clamp a 0 timeout and unbounded alloc hints before they reach the retry loop.
• Classify remote errors precisely — match known error codes (not body.contains), with an inter-cycle retry throttle.

Additive only — no existing rules changed.

[flyq]

• Tighten "permanently failed" in rule 1 (REVIEW.md:20). The codebase deliberately tolerates a failed final report on a chain-following run — the next start re-reports anchor→tip and the miss heals (workers.rs:170-178). Only the slice run fails closed. As written, the rule relies entirely on the word "permanently" to encode that distinction, and the automated reviewer reads this line without the workers.rs context — it could flag the deliberately-tolerant chain-following path as a violation. Suggest: "…must not look like success when the run has no later opportunity to retry (e.g. an --end-block slice run)".