feat(core): the data home, the lens texts, and --version naming both

process/ holds the procedure, the five lens texts, the templates and the
skill under process/skill/prepush/. A lens text's sha256 is part of every
reuse key and the texts are part of every prompt, so they carry no SPDX
header; --version prints the charter hashes: 1728bd4c, 148d5c4c,
c7ffef44 and 2b9a5f83 for the four charters.

Home() finds them: CRAFTER_REVIEW_HOME, natively only (a host setting
must not swap the Flatpak's texts for a checkout's), then
<exe>/../share/crafter-review, then the checkout the binary was built in.
Main() hands `__supervise` to the supervisor before anything else, then
decides the sandbox once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

process/templates/config.json

@@ -0,0 +1,70 @@
+{
+  "base": "origin/main",
+  "rangeFrom": "upstream",
+  "authors": [
+    "you@example.com"
+  ],
+  "aiTrailers": "forbid",
+  "requireSigned": false,
+  "allowDirty": [],
+  "gate0": [
+    "make check"
+  ],
+  "lenses": {
+    "repo-better-solution": {
+      "run": true,
+      "environment": "none"
+    },
+    "repo-functional": {
+      "run": true,
+      "environment": "browser"
+    },
+    "repo-bug-prover": {
+      "run": true,
+      "environment": "none"
+    },
+    "repo-security": {
+      "run": true,
+      "environment": "none"
+    }
+  },
+  "supabase": {
+    "dbUrl": "postgresql://postgres:postgres@127.0.0.1:54322/postgres",
+    "start": null,
+    "stop": null,
+    "notes": ""
+  },
+  "slots": {
+    "dir": null,
+    "start": null,
+    "stop": null,
+    "memMb": null,
+    "startMb": null
+  },
+  "functional": {
+    "appUrl": "http://localhost:8080",
+    "readyPath": "/",
+    "apiUrls": [],
+    "start": "make run",
+    "stop": "make stop",
+    "login": {
+      "fixtures": [
+        ".local-stack/test-user.json"
+      ],
+      "notes": "the fixture holds a TOTP-verified login"
+    },
+    "exclude": [
+      "**/*.test.*",
+      "**/*.spec.*",
+      "docs/**",
+      ".github/**",
+      "*.md"
+    ],
+    "extraTools": [],
+    "mcp": {
+      "command": "npx",
+      "args": null
+    },
+    "notes": ""
+  }
+}

process/templates/manifest.md

@@ -0,0 +1,29 @@
+# <slug> push manifest
+
+repo: <path>   range: <base ref> <base sha> .. <branch> (<n> commits)
+exported: <date>   hash: <sha256 over the exported patch set>
+tree: `.` (the checkout) | `.review-gates/trees/<repo>-<hash8>`
+application: <appUrl>, started with `<functional.start>` from the tree above
+database: <supabase.dbUrl, password masked>, reset from the tree above (when a lens has the supabase environment)
+environments: <lens: environment, as the dump's `environments` lists them>
+dispositions: gate-state/dispositions.json   (the register: every discharge with its grounds)
+gate 0: <the commands run and where their output is kept>
+run line: `run-line.txt` (built from freeze.json)
+
+## Rounds
+
+| round | hash | lens | verdict | findings → action (fixed / refuted(Dn) / waived(Dn) / contested(Dn)) · notes → action |
+|---|---|---|---|---|
+
+INCOMPLETE runs (a lens did not return) are rows marked INCOMPLETE, never a
+pass; test runs with `--only` / `--units` are never rows. A round without the
+functional lens says so in its row: `--without repo-functional.md` (a per-run
+ruling) or `lenses.repo-functional.run = false` in the config (the
+repository's rule).
+
+## Push-time checks (banked from `send-time-check` and `unverified` notes)
+
+-
+
+approved: <date> @ <hash>   (the owner, Gate 4 — saw the frozen patches, the discharged-findings list, contests and notes)
+pushed: <date> <remote>/<branch> @ <sha>   (PR: <url>)