fix: address verified gadfly P5 findings (canary robustness)

All 3 cloud models converged (all "minor" — example code, no blocking):
- Consolidate: a model whose every lens errored now reads "review incomplete",
  not a misleading "no issues found" (all 3 models). + test.
- Consolidate: swarm-cancelled (unattributed) cells now surface a "swarm
  cancelled — N cell(s) did not run" banner instead of vanishing (all 3). + test.
- main: io.ReadAll(os.Stdin) error is surfaced (all 3); a TTY stdin no longer
  hangs forever (TTY guard, minimax).
- providerOf: a bare tier name now keys its own PerKey bucket instead of all
  bare tiers collapsing onto "tier" (minimax, glm-5.2) — distinct tiers throttle
  independently.
- Review doc reworded (the closure, not fanout, carries per-cell errors).

Left as documented example-scope behavior: no per-cell timeout (caller supplies
ctx), unknown-severity → lowest rank (no crash).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

examples/reviewer/main.go

@@ -43,7 +43,16 @@ func main() {
 	flag.Parse()
 	diff := *diffFlag
 	if strings.TrimSpace(diff) == "" {
-		b, _ := io.ReadAll(os.Stdin)
+		// Guard against blocking forever on an interactive TTY (no piped input).
+		if fi, _ := os.Stdin.Stat(); fi != nil && fi.Mode()&os.ModeCharDevice != 0 {
+			fmt.Fprintln(os.Stderr, "reviewer: no diff (pass -diff or pipe one on stdin)")
+			os.Exit(2)
+		}
+		b, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "reviewer: reading stdin: %v\n", err)
+			os.Exit(2)
+		}
 		diff = string(b)
 	}
 	if strings.TrimSpace(diff) == "" {
@@ -80,12 +89,12 @@ func splitCSV(s string) []string {
 }
 
 // providerOf returns a model spec's provider (the first path segment, e.g.
-// "anthropic/claude-…" → "anthropic"; a bare tier name → "tier").
+// "anthropic/claude-…" → "anthropic"; a bare tier name → itself).
 func providerOf(spec string) string {
 	if i := strings.IndexByte(spec, '/'); i > 0 {
 		return spec[:i]
 	}
-	return "tier"
+	return spec // bare tier name → its own bucket (don't collapse distinct tiers)
 }
 
 // perKeyCaps builds the PerKey map: each distinct provider capped at perProvider.