hotfix(ci): render fenced evidence snippets in ai review comments

.github/review-prompt.md

@@ -49,6 +49,7 @@ Use only the review contract in this file plus the generated scope and packet fi
 
 - Return confirmed findings only.
 - Every finding must cite a file path and, when practical, a line number.
+- Each finding may optionally include `snippets`: up to 2 short evidence blocks with `label`, `language`, and `code`.
 - Keep the total finding count small unless the PR genuinely has several distinct problems.
 - If there are no confirmed findings, say so in the summary and return an empty findings array.
 - Use `approved` only when the diff is ready to merge as-is.
@@ -57,6 +58,7 @@ Use only the review contract in this file plus the generated scope and packet fi
 - Fill the structured fields only. The renderer owns the markdown layout.
 - Keep `summary` to plain prose only. Do not include the PR title, a separate verdict line, markdown tables, file inventories, or custom section headings there.
 - Keep `what`, `why`, and `fix` concise plain text. Do not emit headings, tables, or fenced code blocks inside those fields.
+- Use `snippets` only when a short literal excerpt materially clarifies a finding. Keep each snippet under 20 lines, and do not include markdown fences in `code`.
 - Use `securityChecklist` for concise review rows about security-sensitive checks. Provide at least 1 row, and use 2-5 when possible. `status` = `pass` | `fail` | `na`.
 - Use `ccsCompliance` for concise CCS-specific rule checks. Provide at least 1 row, and use 2-5 when possible. `status` = `pass` | `fail` | `na`.
 - Use `informational` for small non-blocking observations that are worth calling out.