audit(rees): verify the Railway enrichment service is called per review + the brief is spliced into the prompt

[JSONbored]

Priority: P2. Child of #1029.

Verify the REES (Railway, enrichment.gittensory.aethereal.dev) is actually exercised end-to-end on the self-host: GITTENSORY_REVIEW_ENRICHMENT=true + REES_URL set in the engine env; buildReviewEnrichment (src/review/enrichment-wire.ts) POSTs to /v1/enrich during a review; the returned brief (promptSection/systemSuffix) is spliced into the prompt next to grounding+RAG (src/services/ai-review.ts); fail-safe on timeout. Deliverables: confirm a real enrichment call in the logs, the brief appears in a review, and the 6 analyzers run; document the wiring. (Was wired before the AI-CLI outage masked all review output — re-verify now reviews flow.)

[JSONbored]

Verified WORKING end-to-end (workflow w8yndovp5): REES is wired (isEnrichmentEnabled true, REES_URL set), reachable (/health ok), and a secret-replay returned a real promptSection+systemSuffix (a lodash-CVE brief) that ai-review.ts splices into the prompt body + system suffix. Gated on GITTENSORY_REVIEW_ENRICHMENT + the convergence allowlist — both true for all 3 repos. Only remaining work = the observability log (buildReviewEnrichment emits nothing on success and swallows failures in a bare catch) so operators can confirm per-review splicing without secret-replay. Scoping down to just that 1-line add.

[JSONbored]

Closing as completed (2026-07-01 issue audit): Advisory-vs-live parity verified working end-to-end; observability logging landed in src/review/enrichment-wire.ts.