append_review: require --domain-review-json when the workspace resolves a domain profile

The bypass, observed live

In e2e workspace test-e2e-20260902 (MP9 "Wild Lily", profile cs2, base lab/cs2-plugin), the driving agent recorded action: continue for three passes while the blocking domain review said reject — not by overriding the gate, but by never presenting it: all three reviewHistory entries carry no domainReview/cs2Review key, and the agent documented why in visualEvidence.notes ("DOMAIN GATE DEFERRED, NOT WAIVED … Not attached via --domain-review-json because append_review then blocks continuation…").

Mechanism

forge/stage4_review/append_review.py hard-blocks action=continue on a non-passing domain review at :373-377, but the whole block is guarded by if domain_review is not None: and --domain-review-json is declared without required=True. Omit the flag and every check vanishes. SKILL.md's "blocks continue" claim is prose, not enforcement.

Proposed fix

When the workspace state resolves a domain profile (state.json profile != "generic"), append_review.py should require --domain-review-json (or an explicit --no-domain-review --reason <text> escape that is recorded in the entry), so non-attachment is a visible decision rather than a silent default.

Context

Found during the two-adversary OpenSpec review of plugin-cs2 change phase-aware-cs2-review (which removes the gate's unsatisfiable-condition provocation but explicitly does not close this bypass — plugin-side deferral semantics land in plugin-cs2 v0.1.2). Until this issue is fixed, the per-pass domain gate's enforcement authority is zero: attachment is optional.