feat(review): review.shared_config — operator-level base manifest overlay

[JSONbored]

Phase 1 — Review output, noise & trust

Context

.gittensory.yml already supports review.profile, path_instructions, instructions, exclude_paths, pre_merge_checks, path_filters (#2043), tone (#2044), and labeling_rules (#2045, PR #3534) — this issue originally bundled all of those plus one more knob as "config-as-code parity fills." The first three sub-items shipped under their own issue numbers (see the pinned comment below); this issue is narrowed to the one genuinely remaining piece.

Goal

review.shared_config: an operator-level BASE manifest that a repo's own .gittensory.yml overlays, so an operator running many repos can express review policy once (e.g. a house review.tone, a default path_filters set, common labeling_rules) instead of copy-pasting it into every repo's container-private config.

Requirements

• Build on the existing container-private config dir (GITTENSORY_REPO_CONFIG_DIR) — a shared base manifest lives at a well-known path within that same directory (e.g. _shared/gittensory.yml or similar, sibling to the per-repo folders), not a new top-level env var.
• Merge semantics: the repo manifest overlays the shared base per-field (repo value wins when set; shared value fills in when the repo manifest is silent on that field), mirroring the existing yml > DB > default precedence rather than inventing a new precedence model.
• Absent shared config ⇒ byte-identical behavior (no shared file present is the default, common case).
• Tests: shared-only (repo silent, shared fills in), repo-only (no shared file), both present (repo wins per-field), and a malformed/unreadable shared file (fails safe to repo-only, never blocks a review).
• Docs: where the shared file lives, its precedence relative to the per-repo manifest and the DB.

Effort

M — this touches the manifest-loading pipeline (not just a new leaf field on the existing schema), unlike the three sub-items that already shipped.

[linear-code]

JSO-2039