Qualify OCR 1.9.5 and review budgets

[xeonvs]

Summary

Qualify checksum-verified Open Code Review 1.9.5 as the tested and recommended baseline for toolkit v0.6.2, and expose OCR's existing aggregate review-token budget as an explicit synthetic GitLab CI control.

The toolkit remains on diff ocr review; it does not add full-repository ocr scan, duplicate OCR telemetry, or hide coverage-changing limits inside model profiles. This PR also classifies the Swift built-in rule changes and reconciles BL-016/BL-017 with the verified 1.9.5 behavior.

Tracks #93. The issue remains open until stable v0.6.2 external delivery and receipt reconciliation.

Implementation

• Promote OCR 1.9.5 in compatibility evidence, preflight, and the checksum-pinned synthetic GitLab example.
• Require --max-tokens-budget in future OCR qualification.
• Expose OCR_MAX_TOKENS_BUDGET=0 and forward it as one quoted argument.
• Document approximate budget enforcement, retained findings, explicit failed coverage, and automatic-approval ineligibility.
• Add a real-executable three-file budget probe with deterministic provider-reported usage.
• Record Swift built-in guidance/default exclusions as a Rules-contract change.
• Keep cross-file relocation and conservative review filtering inside upstream finding-generation/positioning ownership.
• Park BL-016 until model aliases have demonstrated need; keep budget and coverage controls independent.
• Keep BL-017 ready while treating review token/budget telemetry and scan-only output as OCR-owned.
• Add Towncrier feature and rules fragments for v0.6.2.

Requirement-to-evidence and anti-mock review

• The checksum-verified official OCR 1.9.5 executable is the system under qualification.
• The controlled local HTTP peer replaces only the external LLM API beyond OCR's real HTTP/agent/result boundary.
• No double replaces OCR dispatch, usage accounting, manifest generation, JSON serialization, toolkit parsing, or the production subprocess launcher for the claims made.
• A separate real-child-process contract proves both zero and positive budget values reach child argv without shell interpretation.
• Fixture-driven parser/posting/approval tests are not presented as OCR integration evidence.
• The complete test-evidence matrix records production owners, entry points, observables, replaced collaborators, and non-claims.

Validation

• scripts/quality.sh check: 814 tests plus 105 subtests, 81.21% branch coverage; Ruff, mypy, and Bandit pass.
• Complete unchanged suite on Python 3.12.14, 3.13.15, and 3.14.7; each includes real nested-venv wheel/sdist and stdio-MCP integration.
• Official OCR 1.9.5 Darwin arm64 local qualification and hosted workflow run 32000131436.
• Real budget probe: 3 selected, 2 completed with findings retained, 1 failed(budget), summary.budget_exceeded=true, normalized partial outcome.
• Focused compatibility/result/runner/posting/approval/docs tests.
• Two byte-identical HEAD wheel/sdist builds and Twine checks.
• Clean wheel and sdist installs on Python 3.12, 3.13, and 3.14 with isolated import/version and pip check.
• pip-audit, pinned Gitleaks over committed feature history, manifest validation, YAML parsing, Towncrier draft, privacy scan, and git diff --check.
• Examples, fixtures, compatibility peer data, and public documentation are synthetic and private-safe.

Changed boundaries

• External executable compatibility: scripts/ocr_compat.py invokes the official checksum-verified OCR binary and validates required CLI and result contracts. A real local HTTP peer sits beyond OCR and supplies deterministic usage only.
• Subprocess transport: the existing review_runner.run_review production launcher forwards the explicit budget flag/value; no new launcher or shell layer is added.
• Result/reporting policy: existing result normalization, partial finding publication, failed-file coverage, and approval rejection are reused unchanged and revalidated.
• Public configuration/example: OCR_MAX_TOKENS_BUDGET is an explicit optional operator ceiling in the synthetic GitLab contract, not persisted toolkit configuration or a profile default.
• Planning ownership: roadmap, strategy, BL-016, and BL-017 are reconciled without adding runtime architecture.

Security and compatibility impact

• Recommends OCR 1.9.5 and retains Python 3.12-3.14 support with zero runtime dependencies.
• Budget-stopped reviews cannot look complete or authorize automatic approval.
• The toolkit does not adopt ocr scan, duplicate token/budget telemetry, add Swift evidence architecture, or grant OCR internal tools/MCP authority.
• No credentials, private hosts, private repository paths, provider payloads, or private identifiers are included.

Release closure

• All required hosted checks pass on exact head a0d55caad296f14de9839eb283947d754b1633be.
• Review threads/comments are empty and exact head/base were re-read immediately before merge readiness.
• Feature PR was made ready and squash-merged as 13093602a0b40521641447c9d31ed61754e90aea after hosted readiness.
• TestPyPI 0.6.2.dev56 files, hashes, PEP 740 provenance, and Python 3.12-3.14 installs were independently read back from run 32009213205.
• Exact Release v0.6.2 PR is prepared as the final repository mutation.
• Stable TestPyPI/PyPI bytes, provenance/attestations, annotated tag, immutable Release, receipt, and supported-Python installs are independently verified.
• Issue [OCR compatibility] Qualify v1.9.5 #93 is closed only through the stable release receipt lifecycle.