feat(acp): support ACP service for OpenCodeReview - #1218

acp/ is a nested Go module. The root ci.yml resolves its package list with
`go list ./...`, which does not descend into a nested module, so nothing in
acp/ was built or tested by any workflow. pages/ has the same problem, and
the repository already solved it there with pages-ci.yml; this follows that
precedent.

The pull_request trigger deliberately has no branches filter. Development
lands on an integration branch first and only reaches main at the end, so
filtering to main would mean the integration pull requests run no CI at all.

make check reports a missing staticcheck and carries on, so the job asserts
`staticcheck -version` succeeds before calling it. Without that step the
workflow could go green having never run the analyser. staticcheck is pinned
to v0.8.1, whose go.mod requires Go 1.26.0; the container ships 1.26.6, so no
extra toolchain is downloaded.

The go.mod tidy check reads `git status --porcelain` rather than `git diff`,
because a newly created go.sum is untracked and git diff would not report it.

The result DTO did not match the JSON the OCR CLI actually writes, so
decoding a real `ocr review --format json` result failed: summary is an
object, findings use content/start_line/end_line, and the review manifest
carries the terminal state and the cancellation classification. Model the
real shape and leave per-comment thinking out so it cannot leak.

BuildScanArgs appended one --path per path, but --path is a single
comma-separated scalar and pflag keeps only the last occurrence, so every
path but the last was silently dropped. Emit one comma-joined --path and
reject paths that contain a comma.

Rewrite the mock to emit the real envelope, assert decoded field values in
the contract tests, and add real-shape fixtures plus an opt-in OCR_BINARY
integration test that pins the --path rule end to end.

Harden `make check`: staticcheck reporting "matched no packages" is now a
failure rather than a vacuous pass, and inline boolean values are validated
with strconv.ParseBool to match pflag.

Implement phase 4 of the ACP adapter. acp/internal/intent turns one
session/prompt into exactly one of a runnable ReviewIntent/ScanIntent, a
clarification, or a rejection. A leading "/" selects the deterministic
slash grammar; everything else is extracted by a single submit_intent
tool call, with strict decoding and deterministic ref/path/extra
validation through the phase 3 contract builders.

The parsing LLM is configured independently from the review LLM
(--parser-provider/model/base-url and OCR_ACP_PARSER_*), so the adapter
does not copy or drift with OCR's provider system.

make -C acp check passes; make -C acp coverage total 93.9%.

Implement phase five execution of validated OCR requests with binary discovery, bounded stdout and stderr handling, structured result decoding, cancellation and timeout precedence, and Unix process-group cleanup. Extend the mock OCR binary with a real child-process scenario so lifecycle behavior is testable without network or real LLM calls.

Constraint: OCR remains an external executable and the orchestrator must not depend on ACP SDK types
Constraint: stdout and stderr must remain isolated with bounded retention
Rejected: Windows Job Object support in this change | platform implementation and runtime evidence are still pending
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Do not mark Windows process-tree cleanup as formally supported until Job Object runtime evidence exists
Tested: make -C acp test; make -C acp check; make -C acp coverage (90.5%); macOS race tests; Windows cross-compilation
Not-tested: Linux runtime matrix and Windows process-tree behavior

Clarify runner channel semantics, preserve critical stream warnings under backpressure, and retain the first observed local termination cause while reporting cleanup failures. Align version probing and result decoding with the documented CLI compatibility contract, and refuse unsupported Windows process-tree execution.

Constraint: Windows execution requires verified Job Object process-tree control.

Rejected: Silently degrade to main-process-only cleanup | it cannot prove descendant reclamation.

Confidence: high

Scope-risk: moderate

Directive: Keep terminal outcomes independently buffered and preserve local cancellation identity when adding cleanup diagnostics.

Tested: make -C acp test; make -C acp coverage (90.1%); make -C acp check; Windows orchestrator cross-compile; git diff --check

Not-tested: Linux runtime process-group behavior and Windows Job Object runtime behavior.

Keep commit clarifications typed as commit reviews and merge compatible natural-language follow-ups with the adapter-owned pending slots.

Constraint: Clarification state must remain deterministic and scoped to the current session.

Rejected: Require the model to repeat all known fields | model output is not authoritative state.

Confidence: high

Scope-risk: narrow

Tested: make -C acp check; make -C acp test; make -C acp coverage

Not-tested: Real LLM endpoint behavior.

The process runner now owns explicit stdout and stderr pipes and closes their write ends only after cmd.Wait returns. This keeps stream readers from reporting file-closed errors before the command's real non-zero exit status is classified.\n\nConstraint: Preserve separate bounded stdout and stderr handling.\nRejected: Keep Cmd.StdoutPipe and Cmd.StderrPipe | cmd.Wait may close them before readers finish.\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Keep pipe ownership and cmd.Wait ordering synchronized when changing process lifecycle code.\nTested: make -C acp check; make -C acp coverage; git diff --check\nNot-tested: GitHub Actions rerun after push

Keep event channel ownership valid for both pre-start failures and normal process runs. A deferred once-only close handles validation and startup exits immediately, while the stream-drain defer preserves the existing guarantee that normal events are delivered before closure. Add a regression test for cancellation of blocked pipe readers so the new stream lifecycle remains covered.\n\nConstraint: ACP callers wait for both the terminal outcome and event channel closure.\nRejected: Restore an unconditional early close alongside the stream close | normal runs could close events before readers finish.\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nDirective: Keep event channel closure once-only when adding additional process or stream exit paths.\nTested: make -C acp check; make -C acp test; make -C acp coverage (90.3% total).\nNot-tested: GitHub-hosted CI rerun.

The phase six adapter imports the ACP SDK from production code, so Go classifies it as a direct dependency. Record that classification to keep the committed module file identical to go mod tidy output in CI.\n\nConstraint: ACP CI rejects any go.mod or go.sum change produced by Go 1.26.6 tidy.\nConfidence: high\nScope-risk: narrow\nReversibility: clean\nTested: go mod tidy; make -C acp check; make -C acp coverage; make -C acp build.\nNot-tested: govulncheck under Go 1.26.6 because the local Docker daemon is unavailable.

…ellation

Merge compatible pending intent fields across clarification turns while preserving explicit list replacement. Check termination before process start and at completion decisions without relying on watcher scheduling, retaining bounded cleanup and consumed wait results.

Constraint: Keep the fixes local to clarification and process lifecycle semantics
Tested: make -C acp check; make -C acp test (race); make -C acp coverage (90.4%); git diff --check
Tested: User reported OCR review found no issues
Not-tested: Linux and Windows runtime validation