Review execution

The review execution switch defaults to off. Pending work pauses before its fenced start decision without losing its input, delivery or attempt count. Work already past that decision may still appear queued during preparation and drains under the existing cancellation, deadline and cleanup checks; disabling does not instantly revoke a provider request or purge data. Re-enable to resume the retained pending jobs.

The review execution guard enforces a monotonic deadline and cancellation checkpoints. A job that reaches its deadline fails with the stable review_deadline_exceeded code; the worker maps it without leaking repository contents or credentials. Provider interruption and real network latency need separate isolated integration acceptance.

The stored execution route is resolved before claiming a queued Job. For an APISIX route, missing or malformed signing credentials suspend queue processing while preserving queued status, attempt 0, input and delivery. Repair the protected settings and start a new worker to retry. Direct Jobs never construct the APISIX signer. Other selected-APISIX failures, including an invalid gateway origin after claim, retain their normal terminal failure behavior; this does not create a general configuration retry mechanism.