fix: address review findings on the conventions branch

- ci: reject a manual dispatch with tag "latest"; concurrency group per tag
- Dockerfile: declare GIT_COMMIT after the module download layer
- Makefile: docker-build targets linux/amd64 by default
- patch.go: no shared package-level pointers; main.go: no init()
- tests: assert that merge replaces managed listener content
- docs: flows.md startup section matches main.go; review saved to docs/reviews

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans-executions/2026-10-08-2028-house-conventions.md

@@ -141,3 +141,15 @@ things could differ from egress on this repo's runner: `actions/setup-go@v5` (uh
 had to install Go with curl instead), and lint is not part of the `check` job, same
 as egress. The unused `GIT_TAG` and `BUILD_DATE` build args are gone;
 `kubernetes-deploy.yaml` is untouched.
+
+## Step 7 — Close out (review)
+
+Ran both reviewer agents on `main...HEAD`; findings and their status are in
+`docs/reviews/2026-10-08-2040-house-conventions.md`. Ten items fixed on the branch, four new
+bugs deferred to the bug-fix phase, one test simplification declined.
+
+Worth noting: the reviewer agents were not registered as agent types when the review
+started (they were added in this session), so they were run as general-purpose
+agents told to follow the agent files. The `:latest` dispatch hole came in with the
+workflow copied from egress and is still open there. Step 7 stays unchecked until
+the branch is pushed and the MR is open.