Recover auto-review reads from corrupt index

[shiny-code-bot]

Why

Part of #130. The indexed auto-review store should keep read paths durable: if the scoped runs.json index is corrupt or unreadable, users should still be able to see recoverable run history from scoped output sidecars and legacy runs. At the same time, mutation paths should not silently write through a corrupt index and risk discarding index-only state.

What

• Split auto-review index loading into strict and recovering modes.
• Use recovering mode for read/lookup paths (list_runs, load_run, finding detail, duplicate lookup).
• Keep writes and lifecycle mutations on strict loading.
• Preserve precedence as healthy scoped index > scoped sidecar > legacy, including corrupt-index fallback where scoped sidecars beat stale legacy records.
• Add regression coverage for corrupt-index recovery from sidecars, legacy fallback, scoped-sidecar-over-legacy precedence, and strict write behavior.

Verification

• cargo test -p codex-auto-review corrupt_index -- --nocapture
• cargo test -p codex-auto-review
• cargo fmt --all --check
• git diff --check
• Read-only agent review pass after the precedence repair reported no blocking findings.