feat: inline COMMENT-state PR review (findings anchored to changed lines)

Phase 3. Alongside the consensus comment, the consolidator now posts ONE Gitea
pull review (state COMMENT — advisory, never request-changes/approve, so it can
never block a merge) whose inline comments anchor each consensus finding to the
exact changed line. The "reviewer integrated with Gitea" the project wanted,
without the blocking.

- review.go: a unified-diff parser (parseDiffNewLines — hunk-length-bounded, so a
  content line that looks like "+++ "/"@@" isn't mistaken for a header), inline
  comment building filtered to lines actually in the diff, and the Gitea reviews
  API client (raw new_position/event=COMMENT fields). Re-runs delete the prior
  gadfly review (body marker) instead of stacking.
- consensus.go: cluster.detail restored (now consumed by the inline comment body);
  renderConsensus takes precomputed clusters; runConsolidate clusters once and
  drives both the consensus comment and the inline review.
- entrypoint.sh: fetch the PR diff and pass GADFLY_DIFF_FILE to the consolidator
  (GITEA_API/TOKEN/PR already in its env).
- README + reusable workflow (`inline_review` input) + entrypoint docs.

Best-effort throughout: no diff / API creds, or any post error → the consensus
comment still stands; the review is never required and never blocks. Validated
the Gitea reviews API + line anchoring live before building. Tests: diff parser
(incl. header-like content + multi-file), inline filtering. gofmt/vet/bash -n clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

entrypoint.sh

@@ -47,6 +47,8 @@
 #   GADFLY_FINDINGS_TOKEN optional bearer token for the gadfly-reports store
 #   GADFLY_CONSOLIDATE    cross-model consensus comment: "auto" (default; on for >=2
 #                         models), "1" force on, "0" force off (one comment per model)
+#   GADFLY_INLINE_REVIEW  when consolidating, also post a COMMENT-state PR review with
+#                         inline comments on changed lines (default on; "0" disables)
 set -uo pipefail
 
 # One model by default: the specialist suite already provides breadth, so a
@@ -320,7 +322,14 @@ fi
 if [ "$CONSOLIDATE" = "1" ]; then
   n_files="$(ls -1 "${FINDINGS_DIR}"/*.json 2>/dev/null | wc -l | tr -d '[:space:]')"
   log "consolidating findings from ${n_files} model(s)"
-  CONSENSUS="$(GADFLY_CONSOLIDATE_DIR="$FINDINGS_DIR" /usr/local/bin/gadfly 2>"${WORKDIR}/consolidate.err" || true)"
+  # Fetch the PR diff so the consolidator can also post an inline PR review,
+  # anchoring findings to changed lines (GADFLY_DIFF_FILE). GITEA_API/GITEA_TOKEN/
+  # GADFLY_PR are already in the binary's environment. Best-effort: an empty diff
+  # just means no inline review.
+  DIFF_FILE="${WORKDIR}/pr.diff"
+  API "${GITEA_API}/pulls/${PR}.diff" > "$DIFF_FILE" 2>/dev/null || true
+  CONSENSUS="$(GADFLY_CONSOLIDATE_DIR="$FINDINGS_DIR" GADFLY_DIFF_FILE="$DIFF_FILE" \
+    /usr/local/bin/gadfly 2>"${WORKDIR}/consolidate.err" || true)"
   if [ -n "$CONSENSUS" ]; then
     BODY="$(printf '%s\n\n<sub>Automated adversarial review by Gadfly — consensus across the model swarm. Advisory only — does not block merge.</sub>' "$CONSENSUS")"
     upsert_comment_body "<!-- gadfly-consensus -->" "$BODY"