code-reviewlisted

Follow these steps in order. `.github/copilot-instructions.md` defines each priority in full and the comment style; this file is the procedure. ## 1. Lint suppression Search every added or changed line in the diff for `//nolint`, `// nolint`, `#nosec`, and `//lint:ignore`. Search `.golangci.yml` changes for `exclusions`, `exclude`, and `nolintlint`. List every hit as `file:line`. Report each hit as its own comment (priority 1). ## 2. Control plane servers and listeners Search the diff under `controlplane/`, `internal/controlplane/`, `cmd/clawkercp/`, and `clawkerd/` for `grpc.NewServer`, `net.Listen`, `net.ListenConfig`, `http.Server`, and `ListenAndServe`. For each hit: 1. Confirm the gRPC server attaches the `controlplane/auth` interceptor in the chain order used by `controlplane/server/grpc_stack.go`. 2. Confirm the certificate, key, and CA files come from a lane that belongs to this listener only. Compare against `controlplane/infracerts`, `controlplane/otelcerts`, and `controlplane/sdscerts`. 3. If the listener uses client certificates instead of bearer tokens, confirm `tls.RequireAndVerifyClientCert` and a CN or SAN pin in `VerifyPeerCertificate`, and confirm the pull request description gives the reason. 4. Confirm there is no `panic`, `log.Fatal`, or `os.Exit`, and that each serve goroutine has a `recover`. Report each failed check as a blocking comment (priority 2). ## 3. `CLAUDE.md` files For each `CLAUDE.md` in the diff, read the file m