feat(run): the repository under review is the freeze record's, not the working directory's

A directory can review repositories other than itself: a workbench whose
config, env file and records serve several, freezing each with --repo and
--out. The run took the working directory for the repository under review:
the prompt named it, the calibration was kept under it, and --trees fell
back to it. The run now reads the repository from the artifact's
freeze.json - the prompt names it and the calibration is kept under it -
and --trees defaults to what the record says: the worktree, else the
repository when it is not the working directory, else `.`, the same rule
that builds the printed run line. The working directory keeps its roles:
the config, the env file, the slots, the lens processes' cwd and every
logged path. A damaged record stops the run at preflight.

interfaces/Crafter.Review-Freeze.cppm

@@ -76,6 +76,18 @@ export namespace Crafter::Review::Freeze {
     // The exact `run` command for a freeze report: built from its fields, never
     // retyped (2026-09-29).
     std::string RunLine(const Json& report, std::string_view outRel, std::string_view trees);
+    // The tree the lenses read for a frozen artifact, as its record says: the
+    // worktree (relative to the directory freeze ran from), else the
+    // repository when it is not `cwd`, else `.`.
+    std::string TreeOf(const Json& record, const std::filesystem::path& cwd);
+    // What an artifact's freeze.json says it reviews: the repository, absolute
+    // (`cwd` when the artifact has no record, or its record names none), and
+    // the tree (TreeOf). A record that is not JSON throws.
+    struct Reviewed {
+        std::filesystem::path repo;
+        std::string tree;
+    };
+    Reviewed ReviewedBy(const std::filesystem::path& artifact, const std::filesystem::path& cwd);
 
     struct Arguments {
         std::optional<std::string> repo;