## Why

The first #372 pilot prepared a valid conflict resolution but sent a 153 KB head-to-merge diff through a safe-output field capped at 10 KB. It never published the repair. The coordinator also did not wake when that worker finished because its dispatch used `GITHUB_TOKEN`.

## Change

- Review the exact diff from Git's automatic merge tree to the proposed merge. Trusted validation checks clean paths and matches the reviewed bytes before publication. The real #372 review shrinks to 1,177 bytes. - Bound reviews to the actual 10,240-byte tool limit and send larger repairs for human review. - Dispatch workers and CI with the existing maintenance token so completion can wake the coordinator. That token needs Actions write permission.

## Verification

`bun test scripts/pr-maintenance` (190 pass), `bun run ci`, `bun run types`, and `gh aw compile pr-readiness-worker` pass. The downloaded #372 proposal validates against the new review base.

## Review flow