Shadow-parity + per-repo cutover (single-writer, rollback dry-run hard gate)

[JSONbored]

Part of #983.

Context

The per-repo cutover is gated on shadow-parity over the source-tagged audit (computeGateParity/isParityCutoverReady, floor ~0.98, MIN_PARITY_SAMPLE 30, ZERO unsafe disagreements; #1024 added the columns + wiring). The single-writer invariant is OPERATIONAL not code-enforced and freeze:<slug> FAILS OPEN — so it must be verified to have taken before flipping, or both reviewwed[bot] and gittensory[bot] write the same PR (the highest-severity operational risk). Cut over ONE repo at a time on the user's explicit signal: awesome-claude (lowest risk) → gittensory → metagraphed LAST (coordinate its separately-owned preview pipeline). An instant-rollback dry-run is a HARD gate before the first real flip.

Deliverables

• Run computeGateParity/isParityCutoverReady over the SHARED source-tagged audit (source=reviewbot vs gittensory); require ≥30 paired, ≥ floor agreement, ZERO unsafe disagreements per repo before its flip.
• Enforce the SINGLE-WRITER invariant: freeze:<slug> reviewbot, then VERIFY the freeze took (it fails open) before flipping gittensory's review flag live — exactly one App writes per repo.
• DRY-RUN the instant rollback (flip flag to shadow + clear freeze) and confirm it works BEFORE the first real cutover — this is a HARD blocking gate.
• Cut over ONE repo at a time on explicit user signal: awesome-claude → gittensory → metagraphed (last; coordinate metagraphed's preview pipeline).
• During the dual-installed shadow window, confirm no double-processing / DLQ divergence (both systems dedup webhooks).

Acceptance criteria

• Each repo flips only after parity passes (≥30 paired, ≥ floor, zero unsafe disagreements) AND the freeze is verified to have taken.
• The instant-rollback dry-run passed before the first flip (HARD gate).
• Exactly one App writes per repo at all times; no duplicate/conflicting comments or check-runs during cutover.

Acceptance criteria (blocking)

• Rollback dry-run PASSED before first flip.
• freeze:<slug> verified taken (not assumed) before each flip.

Notes

• Milestone: M1
• Depends on: GitHub App identity unification + atomic webhook-secret swap (retire reviewwed[bot]) #1026
• freeze:<slug> fails OPEN — a failed-open freeze with both Apps writing is the single highest-severity operational risk in the plan. The rollback dry-run is a hard gate, not a sub-bullet.

[JSONbored]

Closing as completed (2026-07-01 issue audit): Parity gate shipped (parity.ts/stats.ts isParityCutoverReady) and per-repo cutover executed.