Keep PR review collaboration alive beyond author sessions

[baicaicc]

What changed

• Add botmux pr-room open|adopt|repair|finish|list for a durable PR-scoped Feishu review group.
• Reuse Botmux federation to invite author/reviewer agents and their human Owners.
• Add authenticated remote reviewer preparation so cross-deployment agents trust the group before kickoff.
• Persist structured reviewer/workdir/Owner setup intent with atomic repair claims and finish-safe lifecycle transitions.
• Prevent duplicate groups after ambiguous or crash-interrupted creation; require explicit adopt or finish + --reopen reconciliation.
• Document the workflow and its current distributed-uniqueness boundary.

Why

PR review handoffs currently depend on an ad-hoc group and a live author session. If the author session closes or the Owner creates a separate group, agent context and follow-up can be lost. PR Rooms make the collaboration durable and recoverable until merge, close, or explicit abandonment.

Safety and concurrency

• PR URL (including SCM host port) is the lifecycle key.
• Concurrent setup repair uses a single attempt token, so kickoff is not duplicated.
• finish waits for a live setup attempt, then resolves atomically.
• Expired creation claims become indeterminate instead of automatically creating another group.
• A room is never marked ready while setup has an error or unresolved Owner/reviewer/workdir state.

Validation

• pnpm build
• tsc --noEmit
• 63 targeted unit tests
• Full unit suite: feature tests pass; the same 15 baseline environment failures remain (node:sqlite, fake Codex ESM fixture, Linux process scan/timeouts, hook/MCP sandbox environment)
• git diff --check
• Independent code review: APPROVE
• Independent architecture/concurrency review: CLEAR

Known boundary

Cross-deployment simultaneous open calls do not yet share a distributed uniqueness lock. The documented contract is to invoke open from the PR author's hub/main deployment.

[baicaicc]

@deepcoldy 已完成实现并请求 Code Owner review。验证包括 pnpm build、63 项定向测试、完整 suite 基线对比，以及独立 code/architecture 双审。

我也用本分支实际创建了对应的 Botmux PR Room，双方 agent 已入群、作者 worktree 已绑定。由于你的部署尚未包含本 PR 新增的 /api/federation/delegate-prepare-review，首次自动 reviewer kickoff 按设计落为 active/degraded，未误报成功；我已在群里写明自举状态。合入并升级后执行 botmux pr-room repair https://github.com/deepcoldy/botmux/pull/573 即可完成远端 trust 与 kickoff。

[baicaicc]

将此 PR 退回 Draft，暂停实现推进与合入。

原因：这个能力涉及 Botmux 的群组、federation、session、权限信任、调度和生命周期边界，应该先完成对既有能力与架构的系统盘点，再决定是否需要新增 pr-room 概念、应该落在哪一层，以及最小兼容演进路径。当前代码保留为 design spike / 可执行原型，暂不作为已批准方案。后续会先提交架构分析、备选方案与明确的 acceptance criteria，再决定重构、缩小或废弃当前实现。