feat: import GitHub review threads into the inbox with scoped follow-up (#306)

docs/features/pipeline.md

@@ -68,7 +68,9 @@ The table is the coordinator's record of what has run. It is not verification, r
 | `pipeline.fresh-base-uncertain` | A base the fresh fetch cannot reach refuses Push as uncertain, with or without `--allow-behind`, attempts no push, and re-derives the Rebase row as blocked instead of keeping the earlier pass | automated: `go/internal/cli/pipeline_freshbase_test.go` | offline suite |
 | `pipeline.pr-fresh-base` | `pipeline pr` fetches the base again before creating or adopting a PR and refuses to create one against a base that moved since the push, creating nothing, until `--allow-behind`; `pipeline run --allow-behind` passes the flag to both Push and PR (`go/internal/pipelinerun/pipelinerun.go`) | automated: `go/internal/cli/pipeline_freshbase_test.go` | offline suite |
 | `pipeline.pr-mergeability` | `pr reconcile` and `pipeline ci` record GitHub's `mergeable` and `mergeStateStatus`; an open PR reported `CONFLICTING`/`DIRTY` blocks the PR row with the merge-the-base remedy and shows under `maintenance.open_prs` with `blocked` and `fix`, and a later `MERGEABLE` observation passes the row again | automated: `go/internal/cli/pipeline_freshbase_test.go` | offline suite |
-| `pipeline.pr-read-retry` | Exactly two read-only observations in `go/internal/prcmd`, `gh pr view` (`pr reconcile`, `sweep`) and `gh repo view --json visibility` (evidence publication), make at most one second attempt, and only after a conclusively completed nonzero exit whose stderr positively names a transient condition: an `HTTP 5xx` status line, `HTTP 429`, gh's secondary-rate-limit sentence, or a transport failure as gh prints it (`error connecting to`, `connection refused`, tls or x509 handshake errors). Both attempts and the delay between them share the one existing `GHBound`: attempt one runs on the runner's own timer unchanged, attempt two receives only the time left, and a delay that would not leave a floor for a second attempt defers instead of overrunning. A runner error (timeout, cancel, oversized or incomplete output, uncertain descendant), an auth failure, 404, any other 4xx including a bare 403, a `GraphQL:` application error, malformed JSON, or ambiguous stderr is never retried; no write (agent launch, PR create, edit, ready, publish, push, merge) and no other `gh` read gains a retry, and `go/internal/proc` keeps its no-retry contract. A failure after the retry is still an uncertain observation naming the attempt count and category with token shapes redacted and the detail capped; the prior `pr` record and `observed_at` stay as recorded and `sweep` stamps `observe_failed_at` as before | automated: `go/internal/prcmd/readonly_test.go`, `go/internal/prcmd/pr_test.go` | offline suite against counting fake `gh` scripts: transient-then-valid succeeds after exactly two calls, persistent 503 fails after exactly two, each non-transient shape makes one call, a 429 with a short bound defers after one call, a slow first attempt leaves no budget, the runner called directly runs once, and a Go source-parsing pass over the package pins the helper's callers to `viewPR` and `observedVisibility`. Implementation: `go/internal/prcmd/readonly.go`. |
+| `pipeline.pr-read-retry` | Read-only `gh` observations in `go/internal/prcmd` make at most one second attempt, and only after a conclusively completed nonzero exit whose stderr positively names a transient condition: an `HTTP 5xx` status line, `HTTP 429`, gh's secondary-rate-limit sentence, or a transport failure as gh prints it (`error connecting to`, `connection refused`, tls or x509 handshake errors). The `gh pr view` and `gh api graphql` PR reads (`pr reconcile`, `sweep`) share one bound per observation; `gh repo view --json visibility` (evidence publication) retains its existing bound. Attempt one runs on the runner's own timer unchanged, attempt two receives only the time left, and a delay that would not leave a floor for a second attempt defers instead of overrunning. A runner error (timeout, cancel, oversized or incomplete output, uncertain descendant), an auth failure, 404, any other 4xx including a bare 403, a `GraphQL:` application error, malformed JSON, or ambiguous stderr is never retried; no write (agent launch, PR create, edit, ready, publish, push, merge) and no other `gh` read gains a retry, and `go/internal/proc` keeps its no-retry contract. A failure after the retry is still an uncertain observation naming the attempt count and category with token shapes redacted and the detail capped; the prior `pr` record and `observed_at` stay as recorded and `sweep` stamps `observe_failed_at` as before | automated: `go/internal/prcmd/readonly_test.go`, `go/internal/prcmd/pr_test.go` | offline suite against counting fake `gh` scripts: transient-then-valid succeeds after exactly two calls, persistent 503 fails after exactly two, each non-transient shape makes one call, a 429 with a short bound defers after one call, a slow first attempt leaves no budget, the runner called directly runs once, and a Go source-parsing pass over the package pins the helper's callers to `observeReviewThreads`, `viewPR`, and `observedVisibility`. Implementation: `go/internal/prcmd/readonly.go`, `go/internal/prcmd/threads.go`. |
+| `pipeline.review-threads` | An explicit `pr reconcile` records cursor-paginated GitHub review threads and the overall review decision only when the returned PR number, URL, and head match the identity observation; each thread retains its stable node ID, source URL, file and supplied lines, latest comment identity, author, update time, resolution/outdated state, and observed head/time. The read has a 20-page maximum of 50 threads per page and shares one `GHBound`; a failed, incomplete, nonadvancing, or mismatched response is marked uncertain and keeps previously observed threads with their original per-thread observation time/head. Reconciliation is the only GitHub read for these rows; later saved-state projections do not poll. | manual: no automated thread-observation coverage in this candidate. | The CLI before/after transcript checks saved thread visibility only; pagination, partial observations, and retention are not verified. |
+| `pipeline.review-thread-actions` | The saved inbox and `context --section review_threads` expose source URL, author, file/line, freshness, state, and Address selected/all, Discuss, Draft reply, and Open comment actions. Actions revalidate PR URL/head and exact comment revisions. Address records one idempotent request with every included thread/revision and uses `repair.Send`; changed selections and incomplete Address-all snapshots are refused. Uncertain and submitted requests stay linked to their threads and cannot be resent. Discuss and Draft reply are local records; no action publishes a reply or resolves GitHub state. | manual: no automated coverage in this candidate. | The CLI before/after transcript checks saved thread visibility only; Address revalidation, duplicate prevention, and delivery behavior are not verified. |
 | `pipeline.push-from-the-pr` | A reconciled PR whose head is this candidate passes Push on its own, because the candidate demonstrably reached origin | automated: `go/internal/pipeline/derive_test.go` | offline suite |
 | `pipeline.run` | `sumctl pipeline run TASK_ID` runs rebase, test, lint, document, push, and PR in order, stops at the first failing gate, and at a blocked Test, without running the rest, skips a candidate that is already verified unless `--rerun`, skips lint when `verify --execute` already recorded it, and prints the first unsettled stage with what to do about it | automated: `go/internal/cli/pipeline_gates_test.go` | offline suite |
 | `pipeline.admit-review` | Direct `pipeline push` and `pipeline pr` refuse before any remote write when independent Review is missing or is not an approve for this candidate; `--allow-behind` does not waive Review | automated: `go/internal/pipeline/admit_test.go`, `go/internal/cli/pipeline_gates_test.go` | offline suite |