[OCR compatibility] Qualify v1.10.0

[xeonvs]

OCR v1.10.0 compatibility evidence

• machine result: compatible
• classification: human-review-required
• all upstream asset digests and sha256sum.txt: verified
• Linux amd64 version/help/preview/result-consumer probes: passed
• canonical hosted run: https://github.com/xeonvs/open-code-review-toolkit/actions/runs/32825123658
• Linux amd64 SHA-256: f8f99ea071bed77dbcaa15fdd2083287bb8ae408d5928b3943ebe0788d191b6b

Upstream release changes

• release: https://github.com/alibaba/open-code-review/releases/tag/v1.10.0
• compare: alibaba/open-code-review@v1.9.10...v1.10.0
• current tested baseline: v1.9.10
• published: 2026-08-25T05:45:43Z

## 🚀 Features

- feat(agent): group semantically related files for multi-file review (#808)
- feat(cli): add --output flag to write review/scan results to a file (#852)

## 🐛 Bug Fixes

- fix(diff): surface git's own message when a diff command fails (#1039)

**Full Changelog**: https://github.com/alibaba/open-code-review/compare/v1.9.10...v1.10.0

Classification reasons

• candidate is not a newer patch in the tested major/minor line
• release notes contain material compatibility signals

Human checklist

• Review upstream release notes and relevant commits.
• Confirm compatible after source audit plus checksum-verified Linux and Darwin contract probes.
• Confirm tested support and recommended-version promotion in Draft PR Integrate OCR 1.10.0 for toolkit 0.8.2 #134.
• Route the exact final head through protected PR and stable release gates.

Accepted integration contract

• Toolkit 0.8.2 uses OCR 1.10.0 directly; OCR 1.9.10 remains an inherited predecessor and is not an intermediate installation.
• OCR_REVIEW_EFFORT defaults to medium (two rounds); low/high remain explicit operator choices.
• Unset OpenAI completion cap changes from OCR 1.9.10's observed 58888 to OCR 1.10.0's 16384; explicit 4096 remains supported.
• Semantic groups/rounds are private, DLP-bounded, and absent from receipt v5, toolkit telemetry, posting, and approval authority.
• Caller-owned --output/-o is rejected; ocr-ci review --result retains result ownership.
• BL-017 concludes no-new-layer; upstream group telemetry can contain path-derived high-cardinality values.

[github-actions]

Stable v0.8.2 delivery is verified by immutable release asset release-receipt.json in v0.8.2 (SHA-256 0ac489fa17ce376895ae591b8531358f41682df76a86c36f2bf2dbb2e71ca2b3).