Small follow-ups from the August PR sweep

Collecting the small non-blocking items noted while reviewing and merging the August batch, so they are not lost:

• tools/review.py: the 'No changed files detected.' early return in get_affected_flows omits the truncated key added by #853, so clients indexing result['truncated'] hit KeyError on that branch (noted merging #853).
• parser.py ~13591: the NodeNext/ESM suffix-substitution fallback only tries .ts and .tsx, so a ./foo.js specifier no longer resolves to an on-disk foo.jsx (allowJs/Babel layouts), and .mts/.cts sources never resolve (noted merging #845).
• cli.py ~1638: dead-code and forget still resolve the DB path in create mode, so a missing graph leaves an empty .code-review-graph/ dir behind before exiting 1 (noted merging #809; same class as #803 gap 1).
• daemon_cli.py: the UTF-8 stdio reconfigure from #826 covers only the code-review-graph entry point; crg-daemon would need the same call if it ever prints non-ASCII.
• daemon_cli.py: the forced-stop escalation catches only ProcessLookupError; on Windows a vanished PID raises OSError WinError 87, which would surface a raw traceback in a narrow race (noted merging #844).