Run a whole review against the fixture and score it against the answer key

Work item W7: the demo that makes this app judgeable before it has a screen.

It builds two git repositories with known defects planted in them, reviews the
branch pair for real, and prints which of those defects the review actually
found. The manifest is the answer key, so the output is a score rather than an
impression: every planted defect is FOUND or MISSED, and any finding in the
files that are deliberately fine is a false positive named as such.

`--fake` routes every model call through the test double, so the whole demo is
free and deterministic. That mode proves the plumbing carries a correct review
end to end; it proves nothing about review quality, which is what a real run is
for. `npm run demo:fixture -- --fake` currently prints:

  Built the fixture: 8 planted defect(s), 2 file(s) that are deliberately fine.
  ...
  8/8 planted defect(s) found.
  No findings in the files that are deliberately fine.
  outcome            completed
  discarded quotes   0
  open questions     0
  tokens             500 in, 100 out, 10,000 cached read
  cost equivalent    $0.0210
  wall time          0.9s

Step zero of the plan was to prove tsx resolves the @/ alias rather than assume
it. It does, so the script runs directly and the tsconfig.scripts.json fallback
the plan held in reserve is not needed.

Two smaller decisions the output forced. Numbers are grouped by hand rather
than by toLocaleString, because this output is captured as gate evidence and a
locale-dependent separator would make two runs on two machines look different
when nothing about the review changed. And there is no colour: escape sequences
are control characters, which the house style gate refuses, and the output is
written to a file where escapes are noise rather than emphasis.

A real model run writes its event log and score to review/<date>-fg2/, which is
gitignored, and is the maintainer's to judge.

Author: Poolchaos

docs/DECISIONS.md

@@ -604,3 +604,13 @@ verified evidence, in writing, here.
   prompt hash. Editing it after a review has started means the stages are asked
   again rather than replayed, which is correct: a review judged against a
   different account of the change is a different review.
+- 2026-07-31 PROVEN (W7 step zero): tsx resolves the `@/` alias from
+  tsconfig, so the demo script runs directly with no build step and the
+  `tsconfig.scripts.json` fallback the plan held in reserve is not needed.
+- 2026-07-31 DECIDED (W7): the demo prints numbers with its own grouping rather
+  than toLocaleString. The output is captured as gate evidence, and a
+  locale-dependent separator would make two runs on two machines look
+  different when nothing about the review changed.
+- 2026-07-31 DECIDED (W7): no colour in the demo output. Escape sequences are
+  control characters, which the house style gate refuses, and the output is
+  written to a file as evidence where escapes are noise rather than emphasis.

docs/plans/M2-FINISH-PLAN.md

@@ -401,7 +401,7 @@ maintainer at the top of the demo output directory:
 | W4 | review service, artifact lifecycle, its tests               | W1, W2, W3 | DONE   |
 | W5 | pause/resume/cancel determinism tests                       | W4         | DONE   |
 | W6 | bus, manager, instrumentation, SSE route, tests             | W4         | DONE   |
-| W7 | demo script, tsx alias proof, npm script                    | W2, W6     |        |
+| W7 | demo script, tsx alias proof, npm script                    | W2, W6     | DONE   |
 | W8 | docs, gate evidence, FG-2 checklist                         | W7         |        |
 
 ## 3. Decisions fixed by this plan (append to DECISIONS.md as work lands)

package.json

@@ -28,7 +28,8 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "e2e": "playwright test",
-    "db:generate": "drizzle-kit generate"
+    "db:generate": "drizzle-kit generate",
+    "demo:fixture": "tsx scripts/demo-fixture.ts"
   },
   "overrides": {
     "postcss": "^8.5.25",