feat(config): add dormant external-PR review settings (default-off)

Introduce the configuration contract for inbound external-PR review, mirroring
the strategy-engine block: external_pr_enabled (master switch, off),
external_pr_poll_interval_seconds (>=60), external_pr_author_allowlist, and
external_pr_require_human_confirm (default true). All inert by default — no
inbound GitHub call and no untrusted-code execution until the CEO opts in and a
human confirms an ingested PR.

roboco/config.py

@@ -307,6 +307,41 @@ class Settings(BaseSettings):
         ),
     )
 
+    # ==========================================================================
+    # External-PR review ("engine 3") — DORMANT by default
+    # ==========================================================================
+    # An inbound path: a background loop that lists open PRs per active project,
+    # flags ones from external/fork authors, and creates a one-shot review task
+    # for the dedicated reviewer agent. Default OFF — the loop never starts and
+    # no inbound GitHub call is made until the CEO opts in. Untrusted contributor
+    # code is never fetched or executed until ``confirmed_by_human`` is set.
+    external_pr_enabled: bool = Field(
+        default=False,
+        description=(
+            "Master switch for inbound external-PR review. OFF by default; "
+            "when off the poll loop does not run at all."
+        ),
+    )
+    external_pr_poll_interval_seconds: int = Field(
+        default=300,
+        ge=60,
+        description="Seconds between inbound external-PR discovery passes.",
+    )
+    external_pr_author_allowlist: list[str] = Field(
+        default_factory=list,
+        description=(
+            "GitHub usernames trusted as known contributors. Empty means no "
+            "author is auto-trusted; every external PR needs human confirmation."
+        ),
+    )
+    external_pr_require_human_confirm: bool = Field(
+        default=True,
+        description=(
+            "Require an explicit human confirmation before any agent fetches, "
+            "checks out, or executes external contributor code."
+        ),
+    )
+
     # ==========================================================================
     # Workspaces (Multi-Agent Git)
     # ==========================================================================