PIV loop review for ROY-29

Result: FAIL

Token usage: input 185245, output 2270, total 187515

I reviewed the branch changes and ran all required quality gates (bun run check, bun run typecheck, bun test), and the suite passed (60/60). I found one behavioral bug in review parsing: parseReviewOutcome treats malformed BUGS_JSON as an empty bug list and can still return passed=true when RESULT: PASS is present, which can incorrectly mark a failed/invalid review as success and advance workflow state to done instead of blocked.

Bugs were detected and converted to GitHub issues.