Reviewer VM cutover: provisioning record, assignment writer, approve evidence and per-repo builds (follow-up to #425) #495

Follow-up to #425 (#427 tool, #428 image + launcher), found while preparing the first reviewer VM on 2026-10-03. With #427/#428 deployed on the VM, the mail path works end to end (a known-answer mail to the reviewer is answered and the reply reaches the dispatcher), the review tool runs host-side, and the sandbox has bun + node and no token. Posting a real review and building a PR from the VM still need:

1. Credential provisioning record. The tool reads the reviewer login and allowed scope only from a provisioning record and refuses every request without one (credential provisioning evidence is unreadable). Nothing on main writes that record. Wanted: a documented, host-side way to create it (login, repos, permissions limited to pull_requests:write + metadata:read, nothing else) without exposing the token.
2. Dispatch assignments. The tool refuses with assignment_missing until an assignment for the PR exists; there is no host-side writer for assignments on main. Wanted: the dispatcher (or a host-side command) records the assignment when a review is dispatched.
3. APPROVE evidence settings. The approve path's evidence configuration has no documented host setup.
4. Per-repo build settings. REVIEWER_CI_WORKFLOW/JOB/BASE is fixed per reviewer, so one reviewer cannot build both cli and flair PRs; flair's test job uses a matrix and ${{ }} expressions, which the launcher refuses; cli's test job now resolves to a node 24 image that is not built on the VM. Wanted: per-repository build selection, a supported way to name a matrix leg, and the image set the repos' jobs need.

Until these land, reviewers keep running on the dispatcher host.