fix: review deleted files diff-first instead of leaving them UNREVIEWED

[rembradtech]

Problem

Since #180, loadScmTargets marks every file a PR removes as UNREVIEWED (deleted file requires diff-first review). A review with any unreviewed file is INCOMPLETE and exits 2, so any PR that deletes a file can never get a complete review — fixing findings doesn't help, the deletion is still in the diff.

Seen live on NoxCodeSolutions/design-system#5 (harness loop): after the Windows spawn fixes, the review ran 34/34 lenses with 0 failures, yet stayed INCOMPLETE solely because of apps/fixture-next/src/index.ts (deleted). The harness holds such a PR for a human after two incomplete reviews.

The local git-diff source has always skipped deletions; only the SCM source marks them unreviewed.

Fix

Do what the reason string asks: review the deletion diff-first.

• A removed file with a patch becomes a target whose content is its removed lines ([deleted] …), numbered by base-file line.
• changedRanges: [] → findings are not inDiff, so they go to the summary's "Findings outside the diff" instead of inline. GitHub anchors inline comments on the head side (line), where a deleted file has no lines; an inline anchor there would make GitHub reject the whole review.
• Still UNREVIEWED: no patch from GitHub (too large / binary), a denied path (checked first, so e.g. a deleted .env never reaches the prompt), or over the byte budget (counted like any projected file).
• Redaction applies as for other files.

This keeps #180's intent (a deletion is not silently ignored) while letting a PR with deletions complete.

Tests

• New test/sources-deleted-files.test.mjs: deletion reviewed from patch with base-file numbering and no inline anchors; no-patch and denied deletions stay UNREVIEWED (denied carries no content); mixed delete + edit reviews both.
• campaign-preflight.test.mjs: the PR-6 fixture that asserts an unreviewed file blocks a campaign now deletes a file without a patch, the case that stays unreviewed.
• Locally (Windows): build + typecheck pass; the new and updated tests pass. packaged campaign command keeps stdout machine-readable when output cannot be written fails identically on main without this change (Windows-specific). The full suite did not finish locally within 20 min, so CI is the authority here.

https://claude.ai/code/session_01CgEWGPjo2rnCHc8C2wfRay