[codex] implement review-pack v0.4

[josediegorobles]

Summary

Implements v0.4 review-pack, a consolidated local report for Bitcoin review packages containing descriptor, PSBT, transaction, script, policy, and notes artifacts.

What changed

• Added btc-risk-lab review-pack --input DIR --format json|markdown [--output FILE].
• Added schema 0.4 ReviewPackReport with detected artifacts, per-artifact summaries, consolidated risk, warnings, missing data, cross-artifact findings, review questions, and limitations.
• Reused the existing transaction, PSBT, script, and descriptor analyzers.
• Added minimum cross-artifact checks for descriptor/PSBT multisig and timelock signals, descriptor threshold limitations, and PSBT/transaction input-output counts.
• Added fixtures under tests/fixtures/review-packs/ and CLI coverage for JSON and Markdown output.
• Updated README, ROADMAP, CHANGELOG, and crate version metadata.

Security boundaries

review-pack performs local file analysis only. It does not sign, create wallets, handle keys, broadcast transactions, or make network calls.

Validation

• cargo fmt
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-features
• cargo run --quiet -- review-pack --input tests/fixtures/review-packs/complete --format markdown

Known limitations

Cross-artifact checks compare available heuristic signals and input/output counts. The report explicitly does not prove descriptor-to-PSBT equivalence, transaction extraction from a PSBT, exact threshold/signer-set ownership, wallet state, or consensus/policy validity.

[Copilot]

Pull request overview

Implements the review-pack v0.4 feature, adding a new CLI subcommand that analyzes a local directory of Bitcoin review artifacts (descriptor, PSBT, transaction, script, policy, notes) and emits a consolidated JSON/Markdown report with cross-artifact checks.

Changes:

• Added review-pack analysis pipeline and v0.4 ReviewPackReport schema/reporting.
• Added Markdown/JSON rendering and CLI wiring for btc-risk-lab review-pack ... [--output FILE].
• Added fixture review-pack directory plus CLI regression tests, and updated docs + crate version to v0.4.0.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/fixtures/review-packs/complete/tx.json	Adds a transaction fixture for complete review-pack coverage.
tests/fixtures/review-packs/complete/script.txt	Adds a script fixture (CSV-related opcode) for review-pack coverage.
tests/fixtures/review-packs/complete/psbt.base64	Adds a PSBT fixture for review-pack coverage.
tests/fixtures/review-packs/complete/policy.json	Adds a policy JSON fixture to be surfaced in the report.
tests/fixtures/review-packs/complete/notes.md	Adds notes fixture content for review-pack coverage.
tests/fixtures/review-packs/complete/descriptor.txt	Adds a descriptor fixture for review-pack coverage.
tests/cli.rs	Adds CLI regression tests for review-pack JSON stdout and Markdown file output.
src/review_pack.rs	Introduces the review-pack analyzer, schema structs, and cross-artifact checks.
src/report/mod.rs	Adds rendering for ReviewPackReport in JSON and Markdown.
src/main.rs	Adds review-pack subcommand and output-to-file support.
src/lib.rs	Exposes the new review_pack module publicly.
ROADMAP.md	Marks review-pack capability as completed and clarifies non-goals.
README.md	Documents the new command, artifact inputs, and limitations.
CHANGELOG.md	Adds v0.4.0 release notes for review-pack.
Cargo.toml	Bumps crate version to 0.4.0.
Cargo.lock	Updates lockfile version entry for 0.4.0.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.