feat(deploy): give the PR reviewer its own image, like every other agent

pr-reviewer-1 was the one agent with no dedicated image and no compose
builder service — it reused roboco-agent-base, which left it absent from the
compose files entirely (so it looked like the PR reviewer simply was not
there). Make it first-class for parity: add docker/agent-pr-reviewer.Dockerfile
(FROM the base — read-only reviewer, no extra toolchain), an
agent-pr-reviewer-image builder service in both compose files and the registry
compose, the image in the release workflow's publish list, and map
pr-reviewer-1 -> roboco-agent-pr-reviewer in the orchestrator plus its
lazy-build dockerfile map. Supersedes the earlier base-reuse mapping.

docker/agent-pr-reviewer.Dockerfile

@@ -0,0 +1,15 @@
+# PR Reviewer Agent
+#
+# A read-only reviewer: fetches a PR diff via the GitHub API, greps the
+# codebase, and posts one change-request. It never runs or builds the code (the
+# trust boundary — execution only happens later in a dev cell during supersede),
+# so it needs no language toolchain or test runner beyond the base image. It
+# gets its own image for parity with every other agent and so the role is
+# explicit on the compose + release surface. Keeps the base `claude` entrypoint
+# — it is dispatched per review task like the dev/QA agents, not a persistent
+# SDK driver like intake/secretary.
+
+FROM roboco-agent-base
+
+LABEL role="pr-reviewer"
+LABEL description="Read-only PR reviewer - reviews inbound external PRs and posts one change-request"