dev-review-changeslisted

# Review Pending Changes Read-only review before commit or PR - findings only, never edits. ## Steps 1. Enumerate: `git status --porcelain`, `git diff --stat`. Diff = uncommitted changes plus commits ahead of the target branch (an explicit base ref overrides). Resolve the base ref and confirm the diff is non-empty **before any deeper work** - a bad ref or an empty diff fails here, cheaply, not halfway through the review. Nothing changed - report and stop. 2. Load the rules that apply to the changed paths (project rules plus pack rules). 3. Read the full diffs (`git diff`, `git diff --cached`) AND the surrounding code - a locally clean change can still break a caller or violate a boundary. 4. **Two independent axes when a spec drove the change** - review conventions and review intent separately, and never merge their rankings (a strong result on one axis must not mask a miss on the other): - **Standards axis**: the checks in step 5, against rules and sibling code. - **Spec axis**: the diff against the spec's requirements - each requirement delivered, partially delivered, or missing; scope creep the spec never asked for; each finding quoting the requirement it maps to. Report the worst finding per axis, not one winner across both. Without a spec, run the standards axis alone. 5. Check, grouped by severity: - **Critical** (block): correctness bugs; boundary/layering violations; credentials anywhere in the reviewed diff (run `git-scan-secrets`, `diff` scope); weake