fix(review): sync REES_ANALYZER_NAMES allowlist with the real analyzer registry

[JSONbored]

Context

REES_ANALYZER_NAMES in src/review/enrichment-wire.ts:157-177 is the engine-side allowlist that gates which analyzer names an operator can set via REES_ANALYZERS (validated in resolveReesAnalyzers, enrichment-wire.ts:269-300). It currently has 19 entries. The real analyzer registry (review-enrichment/src/analyzers/registry.ts, plus review-enrichment/src/analyzers/dependency/descriptor.ts and review-enrichment/src/analyzers/secret/descriptor.ts) has 25 real, wired-up analyzers with working run functions in the exported ANALYZER_DESCRIPTORS array.

Six registered, functional analyzers are missing from the engine's allowlist: duplication, churnHotspot, blameLink, approvalIntegrity, ciCheckSignals, undocumentedExport. git log shows the engine-side list was last touched adding docCommentDrift; the three most recent registry additions (duplication, approvalIntegrity, ciCheckSignals) landed afterward without a corresponding update to this constant, and churnHotspot/blameLink/undocumentedExport were apparently missed even earlier.

Impact

An operator who sets REES_ANALYZERS=duplication (or any of the other 5) has it silently rejected by resolveReesAnalyzers as unknown, logged as rees_analyzer_config_invalid, and dropped from the effective selection. If it's the only name configured, the resolved list is empty and REES effectively runs zero analyzers for that request — a silent, total feature disablement with no error surfaced to the operator. All six analyzers are already documented as usable on the self-hosting-rees and self-hosting-rees-analyzers docs pages (both correctly reflect the real registry, generated from review-enrichment/src/analyzers/registry.ts via the metadata:check script) — the mismatch is entirely in the hand-maintained engine constant.

Goal

Bring REES_ANALYZER_NAMES back in sync with the real analyzer registry, and add a guard so this can't silently drift again.

Requirements

• Add the 6 missing names (duplication, churnHotspot, blameLink, approvalIntegrity, ciCheckSignals, undocumentedExport) to REES_ANALYZER_NAMES in src/review/enrichment-wire.ts.
• Add a test that fails if REES_ANALYZER_NAMES and the real registry (review-enrichment/src/analyzers/registry.ts's exported analyzer names) ever diverge again, so this doesn't silently recur on the next new analyzer.
• Verify resolveReesAnalyzers correctly accepts all 25 names end to end, including the 2 analyzers whose descriptors live in separate files (dependency, secret).
• No behavior change for the 19 already-recognized names.

Deliverables

• REES_ANALYZER_NAMES extended to all 25 real analyzer names
• A regression/parity test asserting REES_ANALYZER_NAMES matches the real registry's exported analyzer names
• Confirmation that REES_ANALYZERS=duplication (and the other 5 previously-missing names) resolves correctly instead of triggering rees_analyzer_config_invalid

Expected outcomes

• All 25 documented analyzers are actually configurable via REES_ANALYZERS, matching what the docs already promise
• A future new analyzer added to the registry without updating this constant fails CI immediately instead of silently shipping a docs/engine mismatch

[linear-code]

JSO-2575

[JSONbored]

Verified against current main (2026-07-04): this is already fixed. REES_ANALYZER_NAMES was extracted into a canonical shared file (src/review/enrichment-analyzer-names.ts, back in #2808) and has been kept in sync by several since-merged PRs (including #2958). Diffed it programmatically against review-enrichment/src/analyzers/registry.ts's real 28 imported analyzers just now — exact match, zero drift in either direction. The 6 originally-missing analyzers this issue named (duplication, churnHotspot, blameLink, approvalIntegrity, ciCheckSignals, undocumentedExport) are all present. Closing administratively; no remaining code work.