feat: inline COMMENT-state PR review (findings anchored to changed lines)

Phase 3. Alongside the consensus comment, the consolidator now posts ONE Gitea
pull review (state COMMENT — advisory, never request-changes/approve, so it can
never block a merge) whose inline comments anchor each consensus finding to the
exact changed line. The "reviewer integrated with Gitea" the project wanted,
without the blocking.

- review.go: a unified-diff parser (parseDiffNewLines — hunk-length-bounded, so a
  content line that looks like "+++ "/"@@" isn't mistaken for a header), inline
  comment building filtered to lines actually in the diff, and the Gitea reviews
  API client (raw new_position/event=COMMENT fields). Re-runs delete the prior
  gadfly review (body marker) instead of stacking.
- consensus.go: cluster.detail restored (now consumed by the inline comment body);
  renderConsensus takes precomputed clusters; runConsolidate clusters once and
  drives both the consensus comment and the inline review.
- entrypoint.sh: fetch the PR diff and pass GADFLY_DIFF_FILE to the consolidator
  (GITEA_API/TOKEN/PR already in its env).
- README + reusable workflow (`inline_review` input) + entrypoint docs.

Best-effort throughout: no diff / API creds, or any post error → the consensus
comment still stands; the review is never required and never blocks. Validated
the Gitea reviews API + line anchoring live before building. Tests: diff parser
(incl. header-like content + multi-file), inline filtering. gofmt/vet/bash -n clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/review-reusable.yml

@@ -61,6 +61,7 @@ on:
       allowed_users:             { type: string, default: "" }   # GADFLY_ALLOWED_USERS (consumer-specific; set in your stub)
       trigger_phrase:            { type: string, default: "" }   # GADFLY_TRIGGER_PHRASE
       consolidate:               { type: string, default: "" }   # GADFLY_CONSOLIDATE — "" => auto (one consensus comment for >=2 models); "0" => one comment per model
+      inline_review:             { type: string, default: "" }   # GADFLY_INLINE_REVIEW — "" => on (post a COMMENT-state PR review with inline comments on changed lines); "0" => off
       # Job wall-clock cap. 90 as a default: the 5-lens suite across a slow lane
       # (claude-code with extended thinking) over two passes can run long.
       timeout_minutes:           { type: number, default: 90 }
@@ -145,3 +146,4 @@ jobs:
           GADFLY_ALLOWED_USERS: ${{ inputs.allowed_users }}
           GADFLY_TRIGGER_PHRASE: ${{ inputs.trigger_phrase }}
           GADFLY_CONSOLIDATE: ${{ inputs.consolidate }}
+          GADFLY_INLINE_REVIEW: ${{ inputs.inline_review }}