Security hardening + cleanups from code review: parseAgentVerdicts now
ignores out-of-batch thread ids and fails safe (disagree) on conflicting
duplicate verdicts for one thread; drop the unused store param from
makePrResponseAgentRunner; correct the rework-bound doc (to-node, not
from-node) and the migration idempotency comment (PK is the re-run guard).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
f1e9ab5587