feat(roles): add the read-only pr_reviewer role end-to-end

A global, read-only PR reviewer agent (pr-reviewer-1) that reviews inbound
external/fork PRs and posts one change-request. Wired end-to-end:

- identity: Role.PR_REVIEWER + agent + ROLE_LEVEL (QA-peer) + REVIEWER_ROLES
- lifecycle: CLAIM_RULES + ROLE_TEAM_RULES + a dedicated claim_pr_review /
  post_pr_review verb pair (distinct from QA's) + the pr_review_done action and
  its in_progress->completed transition; give_me_work / i_am_idle gain the role
- role_config: a read-only RoleConfig (allows_write=False)
- journaling: ALL_CELLS read tier so it can read internal intent like QA
- tracing: post_pr_review requires a learning entry; claim_pr_review is waived
- seeds presentation + factory prompt layer + builtin tools + the agentrole
  enum migration (037) + regenerated verb/lifecycle artifacts

Read-only at /app like QA/auditor; default-off — nothing dispatches review work
until external_pr_enabled. Foundation + role-config + enum suites green; ruff +
mypy clean; orchestrator boots.

alembic/versions/037_agentrole_pr_reviewer.py

@@ -0,0 +1,32 @@
+"""Add 'pr_reviewer' to the postgres agentrole enum.
+
+The PR reviewer (``Role.PR_REVIEWER`` in foundation/identity) is a read-only
+agent that reviews inbound external/fork PRs. Seeding/spawning its agent row
+requires the postgres ``agentrole`` enum to carry the value. Mirrors migration
+034's pattern.
+
+Revision ID: 037_agentrole_pr_reviewer
+Revises: 036_ac_ids_and_parent_refs
+Create Date: 2026-06-16
+"""
+
+from __future__ import annotations
+
+from alembic import op
+
+revision = "037_agentrole_pr_reviewer"
+down_revision = "036_ac_ids_and_parent_refs"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    # Unguarded (renders in offline --sql so the enum-migration-parity test
+    # sees it) and idempotent. PG 16 permits ADD VALUE inside a transaction.
+    op.execute("ALTER TYPE agentrole ADD VALUE IF NOT EXISTS 'pr_reviewer'")
+
+
+def downgrade() -> None:
+    # Postgres does not support removing enum values without a destructive
+    # type recreation. Forward-only by design (see migration 034).
+    pass