prompts: add Sashiko review profile

[OllieinCanada]

Summary

• add a bundled Sashiko review profile grounded in current Sashiko production
  boundaries;
• load optional project-context.md guidance through the active workflow prompt
  renderer used by review stages;
• preserve existing profile behavior when that optional file is absent; and
• add deterministic prompt-flow tests using an in-process recording provider,
  with no model or external-service calls.

The profile is not enabled automatically. It can be selected directly with a
local --prompts third_party/prompts/sashiko invocation. PR #447 supplies the
separate daemon configuration seam.

Compatibility and scope

Existing profiles without project-context.md retain their prior generated
system-prompt bytes and provider requests. The change does not alter forge or
NNTP ingestion, Git operations, database schemas, AI-provider implementations,
review publication, or multi-repository behavior.

The guidance focuses on concrete Sashiko invariants: Tokio task and channel
lifecycle, Git/worktree ownership, subprocess cleanup, webhook authentication,
repository URL handling, persistence and retry idempotence, provider failures,
token budgets, secret redaction, and configuration compatibility.

Dependency and rollout

PR #467 must land before or with this PR for reliable upgrades of an already
extracted bundled prompt tree. Without #467, an existing completion marker for
the unchanged bundle revision can leave that installation without the new
sashiko/ directory. Fresh installations and direct source-tree --prompts
usage are not affected.

PR #447 is required only for daemon selection of this profile; local profile
loading and the deterministic tests do not depend on it.

Deterministic tests

The new tests verify the complete bundled profile, exact no-context compatibility,
unchanged recording-provider requests for existing profiles, and Sashiko guidance
reaching actual workflow-stage provider requests.

Exact-head validation against upstream
39f6ce95c797bb40023247916a8b16d0f4aaf0da:

• exact head: d045226e9965ddb8a231f0524df4cfac8444d773
• exact-head local make check-pr: completed with 531 passed, 1 failed, and
  1 ignored; the sole failure was the unchanged upstream timing test
  deadline_budget_credit_wait_deduplicates_overlapping_sleeps, which also
  failed on exact current main, so this is not evidence of a prompts: add Sashiko review profile #455 regression
• matching Signed-off-by validation for every PR commit: passed
• git diff --check origin/main...HEAD: passed
• fresh GitHub checks for this exact head: passed (Signed-off-by, all linters,
  and Rust unit tests)

Independent validation record

A separate, non-PR evidence branch records the combined deterministic checks,
exact identities, limitations, and reproduction notes without adding audit
artifacts to this focused change:
evidence/sashiko-self-review-2026-09-11

No live model review or historical-PR quality benchmark was run. The evidence
therefore supports the deterministic implementation path only; it does not
establish review precision, recall, or production-model reliability.