fix(#1787): post inline comments for COMMENT review verdicts

[fullsend-ai-coder]

The COMMENT early-return in submitFormalReview() was placed before inline comment assembly, unconditionally skipping inline findings even when they had valid file+line locations within PR diff hunks.

Move the COMMENT early-return after findingsToReviewComments() and gate it on len(inlineComments) == 0. When inline-eligible findings exist, submit a formal COMMENT review with the inline comments attached and a body linking to the sticky comment (matching the REQUEST_CHANGES pattern). When no findings are inline-eligible, retain the existing skip behavior.

Tests added:

• CommentSubmittedWithInlineFindings: COMMENT verdict with
  in-diff findings creates a formal review with inline comments
• CommentSkippedWhenFindingsFilteredOut: COMMENT verdict where
  all findings are outside the diff still skips the formal review

Note: pre-commit could not run in sandbox (Go toolchain permission denied). The post-script will run it authoritatively.

---

Closes #1787

Post-script verification

• Branch is not main/master (agent/1787-comment-inline-comments)
• Secret scan passed (gitleaks — 74e81270842f6976b3f6a8514aaa925d84d0d3be..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[github-actions]

Site preview

Preview: https://6f17449d-site.fullsend-ai.workers.dev

Commit: 1af7fe7879a538cbae6f80beb3af6e2da1db5d01

[fullsend-ai-review]

Review

Findings

Medium

• [import-ordering] internal/cli/postreview_test.go:7 — The diff moves stdlib imports (io, testing) after third-party imports (github.com/stretchr/testify/...), interleaving them in a single block without a blank-line separator. Every other test file in internal/cli/ (e.g., postcomment_test.go, readbody_test.go) places all stdlib imports first (alphabetically), followed by a blank-line separator, then third-party imports. The pre-existing file already lacked the blank separator, but the reordering makes the violation more pronounced by placing stdlib imports below third-party ones.
  Remediation: Restore canonical Go import grouping — stdlib first (alphabetically), blank line, then third-party, blank line, then project-internal:

  import (
  	"bytes"
  	"context"
  	"fmt"
  	"io"
  	"testing"
  
  	"github.com/stretchr/testify/assert"
  	"github.com/stretchr/testify/require"
  
  	"github.com/fullsend-ai/fullsend/internal/forge"
  	...
  )

Info

• [logic-correctness] internal/cli/postreview.go:319 — The relocation of the COMMENT early-return from before inline comment assembly to after findingsToReviewComments is correct. The gate on len(inlineComments) == 0 ensures COMMENT reviews are only skipped when no inline-eligible findings survive filtering. Stale review dismissal and minimization still execute before this check, preserving the prior guarantee that COMMENT verdicts dismiss stale CHANGES_REQUESTED reviews.

• [test-adequacy] internal/cli/postreview_test.go — Three new/updated test cases cover the key behavioral matrix: COMMENT-with-inline-findings submits a review, COMMENT-without-findings skips, and COMMENT-with-findings-all-filtered-out skips. Existing test assertions are updated only in message strings, not in assertion logic. No assertion loosening or coverage reduction detected.