Freeze paired review experiment inputs - #18

Issue #3's software prerequisites and review inputs are complete. The human gate has not started.

This PR:

• records Max Hwang as the blinded reviewer and Codex as the experiment operator;
• freezes four comparable Guardyx issue pairs across documentation, agent-key security, asynchronous notifications, and compliance evidence;
• preserves the approved alternating raw-diff/codeboost method pattern after randomizing A/B issue placement;
• adds an explicit non-disclosure boundary for plant inputs and sealed data;
• records the required manual assignment against issue Validate review-summary edge cases before the real-issue experiment #10 / PR Validate review-summary edge cases #17: 12 of 12 segments assigned, attributed, and in scope; and
• records the draft PR and exact base/head revision for all eight experimental packages.

No timed paired review has started. All four pairs are prepared under the frozen rules, every exact review revision passed the Guardyx make preflight gate, no reviewer decision exists, and this PR does not claim that the gate passed. An automated review mistakenly requested on the original pair 3 and pair 4 drafts invalidated those four blinded packages; they were closed and replaced with freshly randomized packages without changing the frozen issues or method assignments. Automated review remains off experimental drafts until their human decisions are recorded.

The initial #554/#556 pair was rejected before implementation because its mandatory live telemetry baseline is unavailable from the operator environment. Inspect-before-build then caught that a proposed replacement, #335, is already fixed on current main despite remaining open. A current-tree audit excluded other stale issues and confirmed that all eight final selections remained unimplemented before work began; A/B placement was randomized only after that audit.

Protocol validation on head f4618ceb2f68af95ec1ed7e302eed24621ca7d92: git diff --check passed and every authoritative preparation-status reference agrees with the replacement table. The implementation tests previously passed with npm run typecheck and npm test -- --run test/review.test.ts test/plant.test.ts (14 tests). The manual assignment was rerun through a fresh SQLite review store from detached head 442147d, and the committed manifest matches all 12 observed stored choices with no duplicate ID.

Review-lesson audit

• Round 1 on 8a226ea: no findings.
• Round 2: accepted the contradictory manual-assignment status and aggregate-only assignment evidence findings; synchronized status documents and added a per-segment manifest plus a reusable evidence rule.
• Round 3 on 576b973: no findings.
• Round 4 on b0afccd: accepted both findings; recorded full 40-character revisions and clarified preparation status.
• Round 5 on c8202bc: no findings.
• Later preparation rounds repeatedly surfaced the same stale pair-status wording as new pair rows were filled. The final update now derives every authoritative status statement from the completed eight-package table and marks all four pairs prepared.
• A final summary-only concern reproduced one stale statement in docs/implementation/build-step-1.md; it now records the completed manual assignment and the prepared but unperformed timed experiment.
• No finding was declined.

Progresses #3.