fix(pr-review): require attribution on every finding

CHANGELOG.md

@@ -10,6 +10,8 @@ Please choose versions by [Semantic Versioning](http://semver.org/).
 
 ## Unreleased
 
+- fix: pr-review — every finding must now lead with a bold file reference (``**`path:LINE`**``, ``**`path`**`` or ``**`path:START-END`**``) and carry the inline `*(rule: <id>)*` tag when it maps to a rule, so a finding is always attributable to a location. The first bold run must *be* the reference, not a summary phrase; a path appearing only in the item's prose does not count and no path may be inferred that was not in the diff. General remarks belong in a trailing `**Notes:**` block, never as a bullet inside a severity section. Measured before the change: 6 of 15 benchmark review attempts (40%) were rejected as unattributable, non-deterministically — after it, 10 of 10 findings across two runs carry a path and no attempt was rejected
+
 - docs: go-testing-guide — document that `go test -v` alone does not enable Ginkgo's verbose reporter, so spec descriptions print only on failure and any `grep -c "<spec name>"` check is satisfiable only by broken tests; use `-v -ginkgo.v`. Adds the two related traps for such checks: `grep -c` exits non-zero when the count is 0 (which is often the pass condition), and a new test description that is a superstring of an existing one defeats any grep pinning the existing one
 
 ## v0.35.4

commands/pr-review.md

@@ -255,6 +255,20 @@ The script exits non-zero if any finding's `rule_id` is not in `rules/index.json
 
 **MANDATORY**: Always include all three headers. Write "None." if empty.
 
+**MANDATORY**: Every finding must be attributable. Write each finding as a list item that **begins** with a bold file reference, and append the rule tag when the finding comes from a rule:
+
+```
+- **`pkg/server/handler.go:42`** — ctx.Done() is never checked in this loop, so shutdown hangs. *(rule: `go-context/cancellation-check`)*
+```
+
+- The item's **first** bold run must **be** the file reference and nothing else — not a summary phrase, not a heading, not the issue's name. `- **Inconsistent due_date choice**` is wrong even though it is bold and first; `- **`task/x.yaml:24`** — inconsistent due_date choice` is right.
+- Accepted shapes, and only these: ``**`path:LINE`**``, ``**`path`**`` (whole file), ``**`path:START-END`**``.
+- A path mentioned later in the prose does not count. Never infer a path you did not see in the diff.
+- Append ``*(rule: `<id>`)*`` verbatim when the finding maps to a rule id from `rules/index.json`; omit it when the finding is not rule-derived.
+- A finding you cannot tie to a file is not reportable as a finding. Put general remarks under a separate `**Notes:**` block after the three sections, never as a bullet inside one.
+
+This applies to every severity section and to all three modes.
+
 #### Must Fix (Critical)
 - Security vulnerabilities, context.Background() in business logic, concurrency bugs, data correctness, transaction deadlocks, business logic in factories, SRP violations (3+ concerns), outdated Go (2+ minor behind), missing test suites, manual mocks, direct time in tests