fix: symlink traversal + worst-wins pre-check + user scoping

Security (MAJOR):
- Add filepath.EvalSymlinks after Clean for system-prompt-file
- Re-validate resolved path is still within workspace
- Prevents symlink → /etc/shadow exfiltration via malicious repo

Worst-wins:
- Check BEFORE posting (not after) — no delete+repost dance
- Identify sibling bots by <!-- review-bot: prefix in body
- Only escalates for bot reviews, not human REQUEST_CHANGES
- If sibling bot has REQUEST_CHANGES and we would APPROVE → post
  REQUEST_CHANGES instead

Addresses security review finding #1 (MAJOR) and sonnet finding #1.

.gitea/actions/review/action.yml

@@ -67,7 +67,7 @@ inputs:
     required: false
     default: 'false'
   update-existing:
-    description: 'Delete previous review from same bot before posting. Accepts: true/1/yes or false/0/no (default true)'
+    description: 'Delete previous review from same bot after posting new one. Accepts: true/1/yes or false/0/no (default true)'
     required: false
     default: 'true'
   system-prompt-file: