persist a claim task's resolved reviewers so the reviewer pin has one owner

[atomantic]

Summary

• Claim tasks now persist the reviewers their prompt names. All three claim generators (/do:next button, JIRA play button, scheduled claim-work router) stamp the resolved bundle — list, @user tokens, ~opt set, and the three keyed pins — onto taskMetadata via reviewerConfigMetadata. resolveReviewerConfig(task.metadata, …) then resolves the same list the prompt body rendered, instead of the install-wide Code Review Defaults.
• The "Reviewer pin" block has one owner. buildClaimFlowCompletionSection emits it once from the task record, covering all five claim task types regardless of which generator built the body. The three per-site appendReviewerPinBlock calls in cosTaskGenerator.js are gone.
• One shared resolver. resolveClaimReviewerConfig (in server/lib/cosValidation.js) replaces five hand-copied resolver calls at each of four sites, and returns the emitted CSV alongside the bundle so the prompt text and the persisted metadata cannot describe different reviewers.

Backward compatibility

A claim task queued before this change carries no reviewer metadata and still falls through to the install defaults — but now routed through the claim copilot guard (claimSafeReviewers), so an in-flight legacy task can't be pinned to copilot, which a claim agent has no CLI to invoke (#2507).

Test plan

• cd server && npm test — 32767 passed, 1563 files green.
• New coverage:
  • server/lib/cosValidation.test.js — round-trip: persisting reviewerConfigMetadata makes a second resolveClaimReviewerConfig reproduce the first CSV; a different install's defaults cannot override what the task persisted; junk keys/values are sanitized out; an empty patch (not null) when nothing survives.
  • server/services/agentPromptBuilder.test.js — the pin renders exactly once, ahead of the handoff, on both the light and full prompt paths; per-reviewer [model]/~opt/~max/~effort suffixes survive into the pinned flag; a legacy claim task never gets a bare copilot; a non-claim task gets no pin.
  • server/services/cosTaskGenerator.test.js — buildClaimWorkTask and buildJiraTicketTask persist the bundle their prompt named and no longer append the pin.
  • server/routes/cos.test.js — the /tasks/slashdo next branch carries the bundle through to addTask.

Closes #4770