fix(review_prs): cite the real pr_review system-prompt binding, not loader.py (review)

The Execution-context section credited `agent/src/workflow/loader.py` with
binding the `pr_review` system prompt, but loader.py has no prompt logic — its
`coding/pr-review-v1 → pr_review` entry is the Cedar *principal* (an
audit/identity tag; read-only enforcement keys off `context.read_only` since
#248 Phase 2a, per the file's own comment). The real system-prompt binding is
`PR_REVIEW_WORKFLOW` in `agent/src/prompts/pr_review.py`, selected by
`get_system_prompt` in `agent/src/prompts/__init__.py:28`.

The claim's conclusion (no slash-command path into the headless review workflow)
was correct, but the cited file would mislead a maintainer who opened loader.py
to verify it — the same trust-eroding mis-citation class as the earlier
allow-list/deny-list mix-up. Now attributes the prompt to the right files and
notes loader.py's entry is the principal tag.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: bgagent

.abca/commands/review_prs.md

@@ -47,9 +47,11 @@ core tool, `Workflow`, is unavailable to headless tasks by construction:
   `disallowed_tools` block, not mere obscurity, is the guarantee: even though the file is on disk and
   reachable on that path, the tool it calls is off the surface.
 - The read-only review workflow (`coding/pr-review-v1`) cannot be steered into `/review_prs`: it is
-  bound to the `pr_review` system prompt (`agent/src/workflow/loader.py`) and drives the agent
-  through that fixed prompt — there is no "invoke a slash command" path, and `Workflow` is
-  deny-listed regardless.
+  bound to a fixed `pr_review` system prompt (`PR_REVIEW_WORKFLOW` in `agent/src/prompts/pr_review.py`,
+  selected by `get_system_prompt` in `agent/src/prompts/__init__.py`) that drives the agent through
+  fixed steps — there is no "invoke a slash command" path, and `Workflow` is deny-listed regardless.
+  (The `coding/pr-review-v1 → pr_review` entry in `agent/src/workflow/loader.py` is the Cedar
+  *principal* audit tag, not the prompt binding.)
 
 In short: operators run `/review_prs`; the ABCA runtime never does, and structurally cannot.