feat(review): targeted per-finding verification context — the verifier reads only the material each finding needs [opt-in]

[devops-thiago]

Sanitized 2026-08-13: this issue is now a single deliverable. Structured outputs was split to #670; the verification-correctness gap is #650 / #475 (cluster in #669). This issue is only the context-scoping efficiency layer.

Problem Statement

The verifier re-reads everything: FindingVerificationService.audit sends all candidates plus the entire batch diff (FindingVerificationService.java:289). For a 5-finding batch over a 30K-token diff, the verifier pays the full diff again even though each verdict only needs the flagged hunks.

Proposed Solution

Build the verifier input per finding instead of per batch: the finding's hunk(s) ± surrounding context from the batch diff (resolvable via the existing DiffLineResolver), grouped by file so findings sharing a file don't duplicate context. Config-gated; off means today's whole-batch-diff behavior.

Effects:

• Verifier input shrinks by roughly the ratio of flagged hunks to batch size.
• The saved tokens can buy a higher AI_REASONING_EFFORT_CONCISE on the verifier at unchanged cost — a smarter skeptic, which is where false-positive elimination actually happens.
• Composition point for the correctness cluster: feat(review): resolve a finding's cited path:line against the real file before the verifier rules on it #650's resolved cited-line snippet and feat(review): codebase-aware context beyond the diff (cross-file analysis) #55's fetched related context attach to exactly the finding they belong to, instead of floating in a shared blob.

Constraints

• The verifier call stays ReviewTokenLedger-gated with usage recorded via Result.tokenUsage().
• Verifier remains fail-open; the deterministic guards (demoteHedgedBlockingFindings, floorInjectionSinkRisk) are unaffected.
• Cross-finding checks the verifier prompt performs today (e.g. duplicate reasoning across candidates) must be re-validated under scoped context — if a rule needs sight of all candidates, the candidates list still travels whole; only the diff material is scoped.

Touchpoints

review/ai/FindingVerificationService.java, review/ai/FindingVerifierPrompts.java, review/DiffLineResolver (context extraction), config/ThrillhouseConfig.java (gate).

Acceptance criteria

• Verifier verdict quality unchanged or better on the eval corpus; verifier input tokens measurably reduced on multi-finding batches.
• Behavior byte-identical with the gate off.

Alternatives Considered

• Keep whole-batch-diff verification — simplest, but the cost scales with batch size rather than with what findings actually cite, and it starves the verifier of reasoning-effort headroom.