Review for essential changes and single source of truth

[adamw]

Reviews now check two more things:

1. Is every change needed for the task?
2. Does each fact have one home? Did the change update every place that encodes it, and every call path to the changed behaviour?

The reviewer prompts were then checked one by one, and for overlap, by separate review agents. This PR also fixes what they found.

New checks

• simplicity checks that each hunk is needed for the task (the user's request in the final review). It flags drive-by refactors, renames, reformatting and unrelated fixes. It does not flag what keeps the repo consistent: updated callers, removing code left unused, tests, docs, formatter output, fixes for review findings, or work another task of the plan owns. The slug is unchanged, so simplicity.md override files still work.
• New single-source reviewer. It searches the repo for other places that encode a fact the change adds, alters or removes. It reports new copies, places left on the old version, contradicting rules and repeated explanations. It ignores duplication the change does not touch, and plans, research notes and superseded ADR text.
• code-functionality checks that the change delivers the whole task, that every caller of changed behaviour still works, and what a failure part-way leaves behind.

One owner per concern

• Duplication moves from code-structure to single-source; premature abstraction stays with simplicity.
• Concurrency correctness (races, deadlocks, ordering, cancellation) moves to code-functionality. performance keeps contention and parallelism: it skips code with no performance implications, where races still happen.
• A path running its own copy of old logic is single-source's; a path the new behaviour does not reach is code-functionality's.
• .orca/reviewers/orca.md drops rules built-in reviewers already cover.

Other fixes

• The picker no longer skips test when no test file changed, since missing tests are its job. test also checks that a test can fail, is deterministic, and that removed or weakened tests don't lose coverage.
• security: an argument vector (os.proc) is the fix for shell injection, not a finding; input is untrusted only if someone other than the operator or author can set it. Adds argument injection and weak crypto.
• scala-fp: runs on .sc too; loads the direct-style-scala skill when available; no longer contradicts it (AtomicReference with pure updates, .catching for foreign exceptions); adds fork ownership, ResourceScope, raw JDK concurrency and null.
• code-structure: no findings cap; judges only the structure the change adds; follows the repo's file convention instead of assuming one type per file.
• orca.md: matches AGENTS.md again (sanctioned mutable state, subprocess exceptions), adds run/backend vocabulary, failure types, listener and WorkspaceWrite.check rules, and now also runs on .md and .properties changes.
• initial-review.md: a reviewer may read code its scope points to. fix.md: the fixer changes only what a finding needs, at every location it lists.
• ADR 0011 amendment, AGENTS.md and docs/using/reviewers.md updated.

single-source will be picked for almost every task, and orca.md now runs on doc changes, so runs cost more reviewer turns.

flow tests pass.