fix(#812): use supported gitea comment REST read-back

docs/scratchpads/812-pr-review-comment.md

@@ -7,7 +7,7 @@
 
 ## Objective
 
-Make the Gitea `comment` action in `packages/mosaic/framework/tools/git/pr-review.sh` use tea v0.11.1's supported `tea comment` command and report success only after provider read-back verifies the created comment against the intended repository, PR, and exact body.
+Make the Gitea `comment` action in `packages/mosaic/framework/tools/git/pr-review.sh` use the supported Gitea comments REST API and report success only after provider read-back verifies the created comment against the intended repository, PR, and exact body.
 
 ## Plan
 
@@ -16,34 +16,36 @@ Make the Gitea `comment` action in `packages/mosaic/framework/tools/git/pr-revie
 3. Implement the minimal supported write plus ID-based provider read-back.
 4. Document that wrapper write output is not durable provenance until read-back succeeds.
 5. Run focused regression tests, touched-package tests, and repository quality gates.
-6. Run independent review, remediate findings, queue-guard, push, and open a PR. Stop at PR-open for coordinator review/merge.
+6. Remediate review findings, queue-guard, and push for coordinator-owned independent review. Do not open or merge a PR.
 
 ## Progress checkpoints
 
-- [x] RED regression committed and reported to mosaic-100 (`3585cdfa`)
-- [x] Initial minimal fix implemented (`c3a83833`)
-- [x] Focused and package tests green after dependency build
-- [ ] Independent review passed
-- [ ] PR opened and reported with exact head SHA
+- [x] RED regression committed and reported to mosaic-100 (rebased commit `770e3f57`)
+- [x] Initial minimal fix implemented (rebased commit `ea7f8c57`)
+- [x] Rebased cleanly onto main `627cf2bb387f7c84a532d88819903a7679ce0d72`
+- [x] Codex blocker remediated by replacing unsupported `tea api` with authenticated REST write/read-back
+- [x] Focused, package, and repository gates green
+- [ ] Coordinator-owned independent review pending after push
+- [x] No PR opened; no self-review or self-merge
 
 ## Tests run
 
-- RED: `bash packages/mosaic/framework/tools/git/test-pr-review-gitea-comment.sh` failed against the old path because `tea pr comment` fell back and the wrapper returned success.
-- GREEN: all `packages/mosaic/framework/tools/git/test-*.sh` harnesses passed.
-- `pnpm build` passed (23/23 tasks).
-- `pnpm --filter @mosaicstack/mosaic test` passed (67 files, 1278 tests).
-- Package and root typecheck/lint/format gates passed.
-- Codex security review found no issues.
-- Codex code review requested changes: tea v0.11.1 has no supported `tea api`; replace read-back with the existing host-scoped authenticated curl/API path when work resumes.
+- RED after rebase: the regression harness failed against `origin/main` with status 1 after reproducing the old `tea pr comment` zero-exit fallback and false success echo.
+- GREEN at resumed head: the same harness passed with REST POST 201 plus GET 200 read-back.
+- All `packages/mosaic/framework/tools/git/test-*.sh` harnesses passed.
+- `shellcheck -x` passed for the changed scripts; `bash -n` passed.
+- Manifest resolver returned `framework` for `tools/git/test-pr-review-gitea-comment.sh`.
+- `pnpm test` passed (43/43 Turbo tasks; Mosaic 75 files/1434 tests; Gateway 56 files/628 tests plus documented skips).
+- `pnpm typecheck` passed (42/42 tasks), `pnpm lint` passed (23/23), and `pnpm format:check` passed.
+- Firewall checks found no user-home paths or operator identities in changed shipped files; no token value is logged or echoed.
 
 ## Risks / blockers
 
-- **Coordination hold:** Mos directed #812 to remain parked until in-flight #789 reaches terminal state because #789 actively uses `pr-review.sh`. Branch must be pushed but no PR opened.
-- Initial implementation's `tea api` read-back is not compatible with tea v0.11.1 and must be remediated before PR.
-- Tea output shape must provide a created comment ID in JSON; failure to parse must fail closed.
-- Read-back must not accept a pre-existing comment with the same body.
-- Existing approve/request-changes behavior must remain unchanged and covered.
+- No active implementation blocker. #789 reached terminal merged state and the coordination hold was lifted.
+- REST transport failures, non-201 writes, malformed/missing created IDs, non-200 read-backs, and read-back mismatches all fail closed.
+- Existing approve/request-changes behavior remains covered.
+- Independent exact-head review remains coordinator-owned.
 
 ## Final verification evidence
 
-Parked pending #789 terminal. No PR opened.
+Acceptance criteria re-verified locally after clean rebase. Branch will be force-pushed with lease for coordinator verification; no PR opened.