feat: initial agent-reviewer meta-agent

A2A agent that audits another deployed agent's source pre-deploy.
Reads the target Gitea repo via a short-lived read-only token minted
through ctx.mint_gitea_token(), runs an inner DeepAgents graph backed
by GiteaBackend, and emits a typed ReviewReport.

Skill bundles:
- security-anti-patterns (credentials, eval, sandbox bypass, egress)
- a2apack-best-practices (class shape, decorators, types, timeouts)
- grant-scope-evaluation (declared vs actual workspace scope)

Tools:
- sandbox_a2a_card  : round-trips the project through microsandbox
- sandbox_ruff_check: objective static checks
- submit_review_report: typed final report

7 smoke tests pass; agent card loads cleanly via `a2a card`.

deploy/20-deployment.yaml

@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: agent-reviewer
+  namespace: agents
+  labels:
+    app: agent-reviewer
+    a2a/managed-by: control-plane
+spec:
+  replicas: 1
+  revisionHistoryLimit: 1
+  selector:
+    matchLabels:
+      app: agent-reviewer
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  progressDeadlineSeconds: 900
+  template:
+    metadata:
+      labels:
+        app: agent-reviewer
+    spec:
+      enableServiceLinks: false
+      terminationGracePeriodSeconds: 30
+      containers:
+        - name: agent
+          image: registry.a2acloud.io/agents/agent-reviewer:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8000
+              name: http1
+              protocol: TCP
+          env:
+            - name: SANDBOX_URL
+              value: http://sandbox.sandbox.svc.cluster.local:8000
+            - name: A2A_SANDBOX_URL
+              value: http://sandbox.sandbox.svc.cluster.local:8000
+            - name: SANDBOX_TIMEOUT_S
+              value: "600"
+            - name: A2A_GRANT_VERIFYING_KEY
+              valueFrom:
+                secretKeyRef: {name: platform-secrets, key: grant_verifying_key}
+            - name: A2A_GITEA_INTERNAL
+              value: http://gitea-http.gitea.svc.cluster.local:3000
+            - name: A2A_GITEA_PUBLIC
+              value: http://gitea.a2acloud.io
+            - name: A2A_CP_URL
+              value: http://control-plane.control-plane.svc.cluster.local
+          readinessProbe:
+            httpGet: {path: /healthz, port: 8000}
+            initialDelaySeconds: 8
+            periodSeconds: 5
+            failureThreshold: 3
+            timeoutSeconds: 1
+          livenessProbe:
+            httpGet: {path: /healthz, port: 8000}
+            initialDelaySeconds: 25
+            periodSeconds: 15
+          resources:
+            requests: {cpu: 200m, memory: 384Mi}
+            limits: {cpu: "1", memory: 768Mi}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: agent-reviewer
+  namespace: agents
+  annotations:
+    argocd.argoproj.io/sync-options: ServerSideApply=false,Replace=true
+  labels:
+    app: agent-reviewer
+    a2a/managed-by: control-plane
+spec:
+  selector:
+    app: agent-reviewer
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8000
+      protocol: TCP