feat(external-pr): CEO decision surface — backend (notify + list + dismiss)

A notification can't be the gate: the reviewer is read-only and the CEO
decides what happens next. Backend for a real PR-review decision queue:

- post_pr_review now notifies the CEO (send_external_pr_reviewed_notification,
  APPROVAL/HIGH, related_task_id) the moment a review lands — server-side
  best-effort (the reviewer has no notify verb).
- TaskService.list_external_pr_reviews_awaiting_decision(): completed
  external_pr reviews the CEO has neither superseded (confirmed_by_human) nor
  dismissed (quick_context dismissed=1 marker).
- TaskService.dismiss_external_pr_review(): CEO declines → marker → leaves queue.
- GET /api/tasks/external-pr-reviews (PM+/CEO) and CEO-only
  POST /api/tasks/{id}/dismiss-external-pr. Supersede already exists.

Panel queue wiring follows in the next commit.

roboco/services/gateway/choreographer/pr_review.py

@@ -161,6 +161,22 @@ class PRReviewerMixin(_Base):
                 logger.exception(
                     "post_pr_review GitHub post failed", task_id=str(task_id)
                 )
+        # Surface the review to the CEO as an actionable decision (supersede /
+        # dismiss). The reviewer is read-only with no notify verb, so the server
+        # emits it. Best-effort — a notify failure must not fail the review.
+        if pr_number:
+            try:
+                from roboco.services.notification import NotificationService
+
+                await NotificationService().send_external_pr_reviewed_notification(
+                    task_id=str(task_id),
+                    pr_number=pr_number,
+                    pr_url=str(getattr(t, "pr_url", "") or ""),
+                )
+            except Exception:
+                logger.exception(
+                    "post_pr_review CEO notify failed", task_id=str(task_id)
+                )
         return Envelope.ok(
             status=str(t.status),
             task_id=str(task_id),