coderail-two-axis-reviewlisted

# CodeRail Two-Axis Review Review one pinned task delta twice so code quality cannot mask incorrect intent, and apparent spec compliance cannot mask repository violations. ## CodeRail boundary - Treat the active CodeRail task as the review unit. - Read `.coderail/tasks.json` only to locate the task activation baseline. - Do not write `.coderail/tasks.json` or edit task state behind the CLI. - Never stage or commit task changes. - Create no review artifact unless its path is already inside task scope. - Keep a requested read-only review read-only. If findings are accepted and fixed in the active task, finish through `python .coderail/coderail.py done`. - Review supplements verification; it never replaces scope checks, registered commands, the canonical repository snapshot, or finalization. ## Pin the delta 1. Resolve the `[~]` task in `docs/TASKS.md` and its stored activation `baseline.head`. Treat generated status projections as potentially stale; report a disagreement, but do not replace the hot task's ownership fact. 2. Validate the baseline with `git rev-parse`. 3. Review the complete worktree delta from that point, including staged, unstaged, deleted, renamed, and untracked task-owned paths. 4. If no stored baseline exists, use `HEAD` only when all task work is known to be uncommitted. Otherwise stop and request an explicit fixed point. 5. Fail early if the fixed point is invalid or the task delta is empty. Capture the fixed point once. Both axes m