feat(revisions): judge pending pairs and select actionable findings (#1014)

[jasonssdev]

Summary

PR 10 of the decision-revision-detector chain, which is Phase B slice P6 (stacked-to-main). It adds the judging half of src/openkos/application/revisions.py:

• judge_revisions judges only P5b's to_judge pairs with the Phase A judge_pairs leaf, through an injected LLMBackend, and persists the results through P3's record_revision_findings keyed by the input digests.
  • Malformed or degraded verdicts are never persisted.
  • Partial batch: judge_pairs returns the completed prefix when a later call fails, so those verdicts are kept and the failure is reported on RevisionOutcome.failure.
• actionable_revision_findings selects the fresh, actionable findings (REVERSES/REFINES at or above the confidence bar, with quotes) that reconcile --from-findings will walk in P8b.
• Confidential send rule. A module-local _load_doc re-checks sensitivity before any chat send, independently of load_decisions's upstream exclusion. This is defense in depth, the same pattern as contradiction._load_doc. --include-confidential releases only the judge's chat send, never an embed call (owner decision B2).

The direction still never comes from the model (ADR-0025).

Size exception

size:exception. About 514 authored lines. The owner authorized finishing Phase B autonomously, taking the recommended option; this is the same call as #1059, #1061 and #1063.

Related issue

Refs #1014

Type of change

• feat — new feature

How was this tested?

• Strict TDD: RED was observed (AttributeError) for both functions. The send-rule test was proven falsifiable by mutation, because it was written in the same pass as _load_doc.
• 3 mutations, each killed: the malformed filter widened; the freshness check dropped from actionable_revision_findings; the should_block gate disabled.
• test_layering.py caught a real layering defect before commit: RevisionOutcome.failure was first typed with the concrete openkos.llm.ollama.OllamaError. It is now BackendError from openkos.llm.base (ADR-0018 D1).
• ruff check ., ruff format --check . and mypy . are clean; pytest --cov 6861 passed (96.99%); evals/run_self_tests.py 43 of 43.

Checklist

• My commits follow Conventional Commits.
• I added or updated tests for the change.
• I updated docs where behavior, interfaces, or the knowledge model changed.
• Lint, format, type check, and tests pass locally (ruff, mypy, pytest).
• Output remains OKF-conformant and derived stores stay reconstructible from the bundle + sources.
• The change is consistent with the project's guiding principles (local-first, provenance, freshness, human-in-the-loop).