Make review entry and decision atomic across every trigger path

Every path that writes review-triggering evidence should atomically enter the canonical root into a versioned review episode under the same concurrency guard. A decision should atomically terminalize the episode's locked root and child set; webhooks, alerts, and analytics run only after commit. Keep global navigation privileges separate from decision authority: deciding requires persisted membership in an authorized customer role, not a synthetic or global-view identity.