Emit human-readable domain label on review findings

[JesperSchulz]

What & why

The live Copilot PR-review consumer is now the reusable engine in microsoft/BC-ALAgents; BCApps delegates to it after microsoft/BCApps#9210. The engine currently maps each finding's from-sub-skill id to a display label through a static $DomainMap. Every new BCQuality review domain therefore requires a matching engine change; otherwise findings silently render as Other.

This PR makes BCQuality own the display label:

• Adds optional findings[].domain to the shared DO output schema.
• Every active AL review leaf sets domain on every finding it emits, including leaf-level agent findings.
• al-code-review preserves a leaf finding's optional domain verbatim during rollup, including its absence from older producers.
• Cross-cutting findings emitted by al-code-review use domain: "Agent".
• If the super-skill upgrades a self-review candidate to a knowledge-backed finding, it takes the label from the owning leaf's Output contract rather than maintaining a second taxonomy map.
• Consumer-facing and plugin documentation describes the same producer-owned behavior.

Labels

Skill	findings[].domain
al-appsource-review	AppSource
al-breaking-changes-review	Breaking Changes
al-data-modeling-review	Data Modeling
al-error-handling-review	Error Handling
al-events-review	Events
al-interfaces-review	Interfaces
al-performance-review	Performance
al-privacy-review	Privacy
al-security-review	Security
al-style-review	Style
al-telemetry-review	Telemetry
al-testing-review	Testing
al-ui-review	Accessibility
al-upgrade-review	Upgrade
al-web-services-review	Web Services
super-skill cross-cutting findings	Agent

Accessibility intentionally preserves the existing rendered label for al-ui-review.

Display-label contract

domain is display text, not a stable machine identifier. Producers emit a non-empty, trimmed, single-line string. Internal whitespace, punctuation, case, and non-ASCII characters are valid and significant.

Consumers must preserve the complete label when rendering it, escaping only for the output format. They must not split on whitespace or restrict labels to identifier characters. Metadata and deduplication keys must retain the exact string, use a lossless encoding, or use a collision-resistant digest; lowercasing or lossy slugification alone is not sufficient because distinct labels can collapse to the same slug.

Backward compatibility

The field is additive and optional in the shared schema:

• Consumers that ignore domain are unaffected.
• Older or partial producers remain contract-valid.
• Consumers must tolerate an absent value and may then use a legacy from-sub-skill fallback.
• A present value is producer-owned and must not be replaced by a consumer taxonomy map.

BCApps no longer hosts the review engine or owns its BCQuality pin. Consumer support and activation now belong in BC-ALAgents.

Rollout

The live consumer counterpart is microsoft/BC-ALAgents#21, Decouple review domains from BCQuality taxonomy.

1. Merge this BCQuality PR.
2. Merge microsoft/BC-ALAgents#21 so the engine prefers a present finding.domain, retains $DomainMap only for legacy findings without it, and safely handles multi-word, punctuation-bearing, and non-ASCII labels in rendering, grouping, metadata, and deduplication.
3. Bump agent/bcquality.config.yaml in BC-ALAgents to a BCQuality commit containing this PR, update its content version, and publish an engine release so the latest tag consumed by BCApps includes both changes.
4. Run an end-to-end review and verify a newly added domain renders with its producer label rather than Other; also verify distinct labels that would share a lossy slug remain distinct.

Validation

• python .github/scripts/validate_frontmatter.py --root . — 0 errors, 0 warnings.
• Contract audit — all 15 active leaves are declared by al-code-review; 27 JSON examples parsed; all 30 populated example findings carry the expected label.
• Live-consumer audit — BC-ALAgents main currently derives labels from $DomainMap; BC-ALAgents#21 is the consumer change that implements this producer-owned contract.

Fixes: AB#640493