feat: specialist suite — configurable + custom review lenses (one consolidated comment)

Replace the single generic review with a suite of focused specialists, each its
own review+recheck pass, merged into ONE comment (a collapsible section per lens,
led by the worst verdict; the optional `improvements` lens never escalates it).

- cmd/gadfly/specialists.go: built-in lenses + default suite (security, correctness,
  maintainability, performance, error-handling) + opt-in (tests, docs, conventions,
  improvements). Selection via GADFLY_SPECIALISTS (csv/"all"); custom defs via
  GADFLY_SPECIALIST_<NAME> env and a repo .gadfly.yml (specialists + define).
  Precedence: built-ins < file < env. Unknown names error but don't sink the run.
- cmd/gadfly/consolidate.go: verdict parse + one-comment render.
- main.go: loop specialists; per-lens failure is an inline notice, never fatal.
  Default timeout bumped to 600s (suite runs sequentially).
- base system prompt trimmed to persona+tools+discipline+output; lens-specific
  focus is appended per specialist (semantic re-derivation discipline kept in base).
- entrypoint default models -> single model (suite already gives breadth; cost ~=
  specialists × models × 2). Adds gopkg.in/yaml.v3.
- docs/examples: README "Specialists" section, examples/.gadfly.yml, stub var,
  CLAUDE.md architecture/config. Dynamic `auto` selection is the planned next step.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

examples/.gadfly.yml

@@ -0,0 +1,34 @@
+# Optional per-repo Gadfly config. Place at the repo ROOT as `.gadfly.yml`
+# (or point GADFLY_CONFIG at it). It's read from the PR's checked-out tree, so
+# it's version-controlled and reviewed like any other file.
+#
+# Precedence for specialist DEFINITIONS: built-ins < this file < GADFLY_SPECIALIST_* env.
+# Precedence for SELECTION: GADFLY_SPECIALISTS env > this file's `specialists:` > default suite.
+
+# Which specialists run. Omit this key to use the default suite
+# (security, correctness, maintainability, performance, error-handling).
+# Built-in opt-ins you can add: tests, docs, conventions, improvements. Or "all".
+specialists:
+  - security
+  - correctness
+  - maintainability
+  - tests
+  - migrations   # a custom one, defined below
+
+# Add new specialists, or override a built-in by reusing its name (e.g. give
+# `security` a repo-specific focus). `focus` is appended to the base reviewer
+# prompt as that lens's instruction.
+define:
+  - name: migrations
+    title: "🗃️ DB migrations"
+    focus: >
+      Review database schema migrations for destructive operations (DROP/ALTER
+      that loses data), missing or unindexed foreign keys, non-idempotent steps,
+      and changes that would lock a large table on deploy. Check that any new
+      column added to a domain struct is wired through every storage layer.
+  - name: security
+    title: "🔒 Security (house rules)"
+    focus: >
+      In addition to the usual security review, this repo requires: all web
+      routes use the auth middleware, no secrets in logs, and all external HTTP
+      calls set a timeout. Flag any violation.