fix(review): keep code-review output in tracking comment only

[varin-nair-factory]

Summary

This PR consolidates code review output into the existing tracking comment to reduce PR timeline noise.

• Removes github_pr___submit_review from code-review tool allowlists in both single-pass and validator paths.
• Adds a guard so user-provided MCP tool overrides cannot re-enable github_pr___submit_review.
• Updates review prompts to publish via inline comments + tracking comment updates only.
• Updates no-findings behavior to only update the tracking comment (no separate review summary comment).
• Adjusts prompt/command tests to match the new behavior.

Scope

Code review flow only (security review flow unchanged).

Validation

• bun test
• bun run typecheck
• bun run format:check

[factory-droid]

Droid finished @varin-nair-factory's task —— View job

---

Code Review Summary

The PR correctly removes github_pr___submit_review from review flows and blocks user overrides. One finding:

• [P1] src/create-prompt/templates/review-prompt.ts line 338 — "ID" is outside the ternary for droidCommentId, so the prompt reads "Update tracking comment ID for this run" when the ID is absent. The validator template handles this correctly; this one should match.