v1.2.8

The convergence seal. The review→merge pipeline can finally converge: a verdict is now a durable property of the exact bytes it judged, so the same commit is reviewed once and its answer sticks — no more oscillation between GOLDEN and NOT-GOLDEN on unchanged code, and no more earned-GOLDEN that never merges. Ships a per-(PR,SHA) binding-verdict ledger, replay-instead-of-re-review, a founder-visible round budget with an on-the-record --grant escalation, a Settings kill-switch that provably stops all review dispatch (with an audit log proving OFF = zero dispatches), and orphan-verdict adoption that survives a crash mid-review. This is the fix that ends the review treadmill.

Convergence — a verdict binds to the bytes it judged

• The review→merge loop is made convergent: every reviewer verdict is recorded in a per-(PR, SHA) binding-verdict ledger, so an unchanged commit is judged once and its answer is authoritative on re-encounter — the same bytes can no longer flip between GOLDEN and NOT-GOLDEN (#4679, #4687).
• Replay-instead-of-re-review returns the bound verdict for a SHA that already has one, ending the re-review churn that let an earned GOLDEN expire without ever merging.
• A founder-visible round budget caps the review rounds a PR may consume, with an on-the-record --grant escalation when more are genuinely warranted — the escalation is audited, not silent.
• A Settings kill-switch provably halts all review dispatch, backed by an audit log that proves OFF means zero dispatches.
• Orphan-verdict adoption lets a verdict written just before a crash mid-review be re-adopted on restart, so a durable answer is never lost to a process death.