feat(postreview): add `VerifiedVariables` and `UncheckedVariables` fields to `ReviewFinding`

[ben-alkov]

What's missing

The ReviewFinding struct in postreview.go lacks fields to track variables
that were explicitly verified or left unchecked during security review

• VerifiedVariables []string (json-tagged)
• UncheckedVariables []string (json-tagged)

Additionally, formatFindingComment needs to be extended to render these fields
in PR comments.

What should happen

1. Add both fields to the ReviewFinding struct with appropriate JSON tags
2. Extend formatFindingComment to include these variable lists in its output
   (minimal formatting, render as-is)

Context

This change supports the structured variable enumeration feature implemented in
fullsend-ai/agents#446. The agent-side schema already produces these fields;
fullsend needs to accept and display them.

Blocks: fullsend-ai/agents#446

Impact

Without this change, fullsend-ai/agents#446 cannot be merged — fullsend
would silently drop the variable tracking data that reviewers need to see.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 4:55 PM UTC · Completed 4:58 PM UTC

Commit: 290c351 · View workflow run →

[fullsend-ai-triage]

Additional implementation notes

Sanitization gap: sanitizeReviewResult currently sanitizes Severity, Category, Description, and Remediation on each finding. The new VerifiedVariables and UncheckedVariables fields will also be interpolated into Markdown posted to the forge, so each string element must be passed through security.OutputPipeline().Scan() to prevent leaked secrets or zero-width obfuscation.

Related issues:

• Review agent: require structured enumeration of verified vs unchecked variables in sanitization findings #2095 — parent feature (structured variable enumeration in review findings)
• refactor: align docs-review finding schema with code-review #944 — refactoring finding schema alignment between code-review and docs-review (not blocking, but the new fields should follow the same conventions)

Proposed test case:

func TestFormatFindingComment_WithVariables(t *testing.T) {
    f := ReviewFinding{
        Severity:           "important",
        Category:           "injection/sql",
        Description:        "Unsanitized input in query",
        VerifiedVariables:  []string{"userID", "sessionToken"},
        UncheckedVariables: []string{"rawInput"},
    }
    got := formatFindingComment(f)
    assert.Contains(t, got, "userID")
    assert.Contains(t, got, "sessionToken")
    assert.Contains(t, got, "rawInput")
    // Verify labels/headers distinguish the two lists
    assert.Contains(t, got, "Verified")
    assert.Contains(t, got, "Unchecked")
}

func TestFormatFindingComment_EmptyVariables(t *testing.T) {
    f := ReviewFinding{
        Severity:    "important",
        Category:    "injection/sql",
        Description: "Some finding",
    }
    got := formatFindingComment(f)
    assert.NotContains(t, got, "Verified")
    assert.NotContains(t, got, "Unchecked")
}

---

Labels: This is a feature for the review agent component with high priority (blocks agents#446). The security label applies since the fields support security review variable tracking.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance