feat(FAFF-398): fail-closed on mandatory review-chain exhaustion

[alechill]

Closes FAFF-398.

What

On a lights-out (L4) run, a mandatory adversarial review whose whole backend chain is exhausted with no opinion obtained (all-unreachable exit 5, or deadline exit 8) now fails closed → needs-human instead of the pass+skip that silently no-ops the L4 second-opinion gate on an outage (recurred: all 4 merges in run-140848). Advisory (L1–L3, flag absent) is byte-for-byte unchanged.

How

• review-call.mjs: new EXIT.MANDATORY_OUTAGE (9) + a pure mandatoryRemap(exit, mandatory) applied once at main()'s res.exit chokepoint — every exhaustion path (the three deadline returns + chain-exhausted) funnels through it, so it is miss-proof by construction; runReviewChain stays level-agnostic. New --lights-out flag.
• SKILL.md: exit-9 row, the --lights-out pass-through (iff forwarded lights_out), the intentional autonomous-vs-lights_out asymmetry, and the checkpoint carve-out (exit 9 is a terminal needs-human, not a skip).
• Config-fault classes (2/4/6/7) pass through unremapped; the Step-10 merge gate needs no edit (needs-human auto-parks via decideFloor).

Acceptance Criteria

• EXIT.MANDATORY_OUTAGE (9) added — test/adversarial-call.test.mjs
• --lights-out → mandatory (default false) — parseArgs test
• pure mandatoryRemap maps 5/8→9 only when mandatory; config-faults + OK pass through — mandatoryRemap test
• single-chokepoint remap covers all terminal loci — main() integration: unreachable→9, deadline→9, served→0, no-flag→5, config-fault(AUTH)→7
• runReviewChain stays level-agnostic (ignores a passed mandatory) — level-agnostic test
• SKILL.md exit-9 row + pass-through + asymmetry — faff validate-adapters passes
• No new eval grader KIND (the seam is deterministic)
  Verified: node --test test/adversarial-call.test.mjs → 80/80; full node --test → 1159 pass / 3 fail (pre-existing docker/spawn, unrelated to this diff); faff validate-adapters → PASS.

Spec: docs/specs/2026-07-07-faff-398-mid-run-fail-closed-on-review-chain-exhaustion-design.md. Settled punts: exit value = 9; exit 9 writes no --phase2 skipped* status.