feat(pilot): minimal AI review bot for Gitea Actions

Ships a working pragent pilot ahead of the framework build (design doc
deferred). Single stdlib-only reviewer script fetched at runtime by a per-repo
Gitea Action; reviews fire only on PRs with the AI-REVIEW label; model is
glm-5.2:cloud via the on-network headroom proxy; fail-open.

- pilot/ai_review.py: fetch PR diff, call model, post review as pragent-bot
- pilot/workflow-template.yml: per-repo Gitea Action gated on AI-REVIEW label
- pilot/README.md: onboarding (bot collaborator + secret + workflow + label)
- tests/pilot/test_ai_review.py: 15 unit tests for pure helpers (no network)
- README/design doc: note pilot is the bootstrap; framework build deferred

Co-Authored-By: Claude <noreply@anthropic.com>

pilot/workflow-template.yml

@@ -0,0 +1,45 @@
+# pragent pilot — AI Review workflow template.
+#
+# Copy this file into the repo you want reviewed as:
+#   .gitea/workflows/ai-review.yml
+#
+# Prerequisites (see pilot/README.md):
+#   1. pragent-bot added as a collaborator with Write access.
+#   2. repo secret PRAGENT_BOT_TOKEN set to the bot's access token.
+#
+# Reviews fire ONLY on PRs carrying the `AI-REVIEW` label. Remove the label to
+# stop a re-review on subsequent pushes. The job is fail-open (never blocks CI).
+
+name: AI Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+
+jobs:
+  review:
+    # Only run when the PR has the AI-REVIEW label. Acts as a cheap gate: no
+    # model call, no cost, when the label is absent.
+    if: contains(github.event.pull_request.labels.*.name, 'AI-REVIEW')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run pragent pilot review
+        env:
+          GITEA_API: http://gitea-http.gitea.svc.cluster.local:3000
+          GITEA_REPOSITORY: ${{ github.repository }}
+          PR_INDEX: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+          PRAGENT_BOT_TOKEN: ${{ secrets.PRAGENT_BOT_TOKEN }}
+          PRAGENT_SHA: ${{ github.event.pull_request.head.sha }}
+          # On-network model: headroom proxy on kubernets (tailnet IP).
+          OLLAMA_URL: http://100.74.17.70:8789
+          OLLAMA_MODEL: glm-5.2:cloud
+          OLLAMA_MAX_TOKENS: "6000"
+          DIFF_MAX_CHARS: "150000"
+        run: |
+          set -e
+          # Fetch the reviewer script from the pragent repo (private → bot token).
+          curl -fsS -H "Authorization: token $PRAGENT_BOT_TOKEN" \
+            "$GITEA_API/api/v1/repos/gitea_admin/pragent/raw/branch/main/pilot/ai_review.py" -o ai_review.py
+          python3 ai_review.py