chore(rules): adversarial review stance and e2e-before-review order

[zaxovaiko]

What

• review skill: new stance section (2b) - reviewers assume the change is broken and review to falsify; stance passed verbatim to every spawned reviewer and applied on the fast path
• quality-reviewer: new first Correctness lens (trace changed behavior with concrete inputs incl. hostile ones; verify callee behavior; tx-scope/outbox consistency on partial failure)
• security-reviewer: assume every protection is bypassable until the stopping path is traced
• contract-reviewer: a contract that compiles can still break every consumer
• add-feature: steps 5/6 swapped - e2e from AC runs BEFORE review; e2e failures return to the implementer first; behavior-changing review fixes re-run affected e2e

Why

Reviewers checked contracts/conventions/security but nobody verified the code works; review effort was spent on unproven code. Evidence gate unchanged - findings still need a traced trigger path.

Mirrors are generated (pnpm sync:agents), only .rulesync sources are committed.