feat(persona): add role-based review personas

Add persona system for specialized review roles. Each persona defines:
- A specific review focus (security, architecture, documentation)
- Custom system prompt additions
- Personality/tone adjustments

Built-in personas: security, architect, docs
Custom personas: load from JSON via persona-file flag

Includes workspace validation to prevent path traversal attacks.

Closes #51

.gitea/workflows/pr-ready-gate.yml

@@ -7,24 +7,16 @@ on:
 jobs:
   clear-labels:
     runs-on: ubuntu-24.04
-    if: |
-      contains(github.event.pull_request.labels.*.name, 'ready') ||
-      contains(github.event.pull_request.labels.*.name, 'self-reviewed')
+    if: contains(github.event.pull_request.labels.*.name, 'self-reviewed')
     steps:
-      - name: Remove ready and self-reviewed labels, reassign to author
+      - name: Remove self-reviewed label, reassign to author
         env:
           GITEA_TOKEN: ${{ secrets.RODIN_TOKEN }}
         run: |
           PR_NUMBER=${{ github.event.pull_request.number }}
           AUTHOR=${{ github.event.pull_request.user.login }}
-          READY_LABEL_ID=38
           SELF_REVIEWED_LABEL_ID=37
           
-          # Remove ready label if present
-          curl -sS -X DELETE \
-            -H "Authorization: token $GITEA_TOKEN" \
-            "https://gitea.weiker.me/api/v1/repos/${{ github.repository }}/issues/${PR_NUMBER}/labels/${READY_LABEL_ID}" || true
-          
           # Remove self-reviewed label if present
           curl -sS -X DELETE \
             -H "Authorization: token $GITEA_TOKEN" \
@@ -37,4 +29,4 @@ jobs:
             -d "{\"assignees\": [\"${AUTHOR}\"]}" \
             "https://gitea.weiker.me/api/v1/repos/${{ github.repository }}/pulls/${PR_NUMBER}"
           
-          echo "Cleared ready/self-reviewed labels and reassigned PR #${PR_NUMBER} to ${AUTHOR}"
+          echo "Cleared self-reviewed label and reassigned PR #${PR_NUMBER} to ${AUTHOR}"