refactor: use tree hash + git diff for post-approval change detection

- Replace commit hash comparison with git tree hash (HEAD^{tree}) to
  avoid false re-review triggers on commit-only operations
- Use git diff --quiet for actual file change detection
- Update source_ref on failed reviewer execution with done verdict
- Add tests for empty-commit finalize and code-change re-review
- Document Codex reviewer bash mutation gap in reviewer-runtime

runners/codex-runner/src/reviewer-runtime.ts

@@ -5,6 +5,9 @@ import path from 'path';
 
 import type { RoomRoleContext } from './room-role-context.js';
 
+// Codex app-server does not expose a BashTool-style pre-use hook, so reviewer
+// mode can only hard-block mutating git via PATH interception here. Non-git
+// shell mutation commands remain a known gap when REVIEWER_AGENT_TYPE=codex.
 const BLOCKED_GIT_SUBCOMMANDS = new Set([
   'add',
   'am',