NU-007 Review gate 1: review queue, edits, Reviewed Source versioning #21

Part of #30.

The first human gate. Every file blocks here; nothing reaches the Compiler unapproved.

Build

• Queue endpoints over documents + reviewed_sources: list pending, fetch one, save edits,
  approve.
• Reviewers edit body content, not just metadata, and correct Content Header fields.
• On approve: freeze a Reviewed Source version — immutable, versioned. This is the
  Evidence root; evidence_span offsets point into it, never into the original bytes.
• Claim work with SELECT ... WHERE state = $1 FOR UPDATE SKIP LOCKED. The review queue is the
  work queue — that is why there is no RabbitMQ. A committed row satisfies restart-safety more
  strongly than an unacked message, and a broker would be a second copy of the same state that
  can disagree with the table about what stage a file is in.
• On re-ingest of changed content: show a raw-v1 → raw-v2 diff alongside the reviewer's prior
  edits; they re-apply manually. No three-way merge.

Why Evidence roots at the Reviewed Source

If reviewers edit the body, offsets into the raw file stop resolving — intermittently, which is
worse than always. Rooting Evidence at the human-approved document fixes it and is stronger:
the citation a user sees is content a person vouched for. The raw original stays reachable one hop
back, and "view original" is a deliberate second action — never the default, or you would be
showing users the uncorrected content the reviewer just fixed.

Watch this

Re-applying edits by hand after every re-ingest is the workflow that decides whether reviewers
engage or start rubber-stamping. If reviewers start approving without reading, the entire
product thesis fails quietly. Instrument it.

Closes

A4 (content-approval half).