feat(review): graceful fallback when org model policy blocks the selected model + clear review errors

[factory-nizar]

Motivation

A customer (Becoming You Labs) tightened their org model allowlist while their review workflows still used the review_depth preset defaults (gpt-5.2 deep / kimi-k2.6 shallow). Review runs died with an opaque 403 This model is not available due to your organization's security settings, and the tracking comment only said "Droid encountered an error" with no reason (Pylon #13165).

Changes

1. Policy-aware model fallback

• Pre-flight (src/utils/model-policy.ts): prepare steps fetch the org model policy from GET /api/organization/managed-settings using the FACTORY_API_KEY and, when the selected model is disallowed, omit --model/--reasoning-effort so droid exec uses the org's default model. A notice is surfaced in the tracking comment. The check fails open: any lookup error preserves today's behavior.
• Wired into all model-selecting flows: review candidates + validator (tag mode and the review/ sub-action), security review/scan (security_model), PR description fill (fill_model), and the GitLab review prepare entrypoint.
• Reactive (base-action/src/run-droid.ts): if a run still fails with the model-policy 403 (policy changed mid-run, custom models, etc), the retry loop strips --model/--reasoning-effort once and retries with the org default.

2. Clear error surfacing

• base-action captures the final stream-json result event and exposes its error text as an error_message step output (plus a one-line Droid Exec failed: ... log even in sanitized output mode).
• update-comment-link.ts / comment-logic.ts render that error in the tracking comment, with an actionable hint when it is a model-policy 403 ("set review_model to an approved model"), and render the fallback notice on success so model switches are never silent.

Drive-by fixes (pre-existing CI breakage on main)

• Duplicate type import in src/core/review/artifacts/write.ts (failed tsc --noEmit).
• Prettier formatting in gitlab/examples/README.md (failed format:check).

Validation

• bun test: 484 pass / 0 fail (includes new test/model-policy.test.ts, base-action/test/model-policy-error.test.ts, and new comment-logic cases)
• bun run typecheck clean in root and base-action
• bun run format:check clean

[factory-droid]

Droid finished @factory-nizar's task —— View job

---

The model-policy fallback approach is solid and well-covered by tests, but the base-action stdout parsing and per-attempt state handling can make fallback detection and surfaced error messages unreliable across retries. Tightening those up will make the new behavior robust under real stream and process conditions.

[factory-droid]

[P1] Reset last result event between retries

lastResultEvent persists across retry attempts, so if an earlier attempt emits a type=result error and a later attempt exits before producing its own result event, the retry logic can miss a model-policy fallback decision and can publish an error_message from a previous attempt instead of the final failure.

[factory-droid]

[P1] Buffer stdout to parse stream-json safely

The new result-event capture relies on text.split("\n") and JSON.parse(line) per stdout chunk, but Node stream chunks can split a single JSON line across chunks. When that happens parsing fails, output is suppressed in non-full-output mode, and lastResultEvent never updates, which breaks model-policy fallback detection and final error_message reporting.

[factory-droid]

[P2] Strip a leading separator when re-rendering comments

updateCommentBody removes the previous completion header but leaves the prior --- separator at the start of bodyContent, then appends a new separator before reattaching bodyContent. On retries or subsequent updates this produces duplicated separators at the top of the preserved content; consider stripping a leading separator during the cleanup pass (near the new stale-notice stripping) to keep updates idempotent.