feat(review): deterministic finding-fingerprint + suppression matcher for review memory

[JSONbored]

Matching-logic slice of #1964: a pure deterministic fingerprint (category + normalized path + normalized message) and a matcher that, given a finding and a set of stored suppression signals, decides demote/suppress/keep. Deterministic-first, bounded, auditable. No DB I/O here (that's the store slice) — this is the pure decision function findings flow through.

Deliverables

• New src/review/review-memory-match.ts with a pure fingerprint(finding) and matchSuppressions(finding, signals) -> 'suppress'|'demote'|'keep'
• Path/category normalization reusing existing path-matcher helpers where possible (src/signals/path-matchers.ts)
• Deterministic-only matching (no AI); bounded input handling
• Tests: exact match suppress, category+path partial match demote, no-match keep, empty signal set, normalization edge cases (branch-counted)

References

• src/signals/path-matchers.ts
• src/review/review-thread-findings.ts:4
• src/services/ai-review.ts:215

Part of #1964.

---

size: S · held for later release (gittensor:feature once activated)

[linear-code]

JSO-2281