feat: Add threaded review comments + agent comment responses

Introduces GitHub-style threaded comments via parentCommentId self-reference.
Users and agents can reply within comment threads, and review agents receive
comment IDs so they can post targeted responses via comment-responses.json.

- Migration 0032: parentCommentId column + index on review_comments
- Repository: createReply() copies parent context, default author 'you' → 'user'
- tRPC: replyToReviewComment procedure, requestPhaseChanges passes threaded comments
- Orchestrator: formats [comment:ID] tags with full reply threads in task description
- Agent IO: readCommentResponses() reads .cw/output/comment-responses.json
- OutputHandler: processes agent comment responses (creates replies, resolves threads)
- Execute prompt: conditional <review_comments> block when task has [comment:] markers
- Frontend: CommentThread renders root+replies with agent-specific styling + reply form
- Sidebar/ReviewTab: root-only comment counts, reply mutation plumbing through DiffViewer chain

apps/server/trpc/routers/phase.ts

@@ -368,6 +368,17 @@ export function phaseProcedures(publicProcedure: ProcedureBuilder) {
         return comment;
       }),
 
+    replyToReviewComment: publicProcedure
+      .input(z.object({
+        parentCommentId: z.string().min(1),
+        body: z.string().trim().min(1),
+        author: z.string().optional(),
+      }))
+      .mutation(async ({ ctx, input }) => {
+        const repo = requireReviewCommentRepository(ctx);
+        return repo.createReply(input.parentCommentId, input.body, input.author);
+      }),
+
     requestPhaseChanges: publicProcedure
       .input(z.object({
         phaseId: z.string().min(1),
@@ -378,15 +389,33 @@ export function phaseProcedures(publicProcedure: ProcedureBuilder) {
         const reviewCommentRepo = requireReviewCommentRepository(ctx);
 
         const allComments = await reviewCommentRepo.findByPhaseId(input.phaseId);
-        const unresolved = allComments
-          .filter((c: { resolved: boolean }) => !c.resolved)
-          .map((c: { filePath: string; lineNumber: number; body: string }) => ({
+        // Build threaded structure: unresolved root comments with their replies
+        const rootComments = allComments.filter((c) => !c.parentCommentId);
+        const repliesByParent = new Map<string, typeof allComments>();
+        for (const c of allComments) {
+          if (c.parentCommentId) {
+            const arr = repliesByParent.get(c.parentCommentId) ?? [];
+            arr.push(c);
+            repliesByParent.set(c.parentCommentId, arr);
+          }
+        }
+
+        const unresolvedThreads = rootComments
+          .filter((c) => !c.resolved)
+          .map((c) => ({
+            id: c.id,
             filePath: c.filePath,
             lineNumber: c.lineNumber,
             body: c.body,
+            author: c.author,
+            replies: (repliesByParent.get(c.id) ?? []).map((r) => ({
+              id: r.id,
+              body: r.body,
+              author: r.author,
+            })),
           }));
 
-        if (unresolved.length === 0 && !input.summary) {
+        if (unresolvedThreads.length === 0 && !input.summary) {
           throw new TRPCError({
             code: 'BAD_REQUEST',
             message: 'Add comments or a summary before requesting changes',
@@ -395,7 +424,7 @@ export function phaseProcedures(publicProcedure: ProcedureBuilder) {
 
         const result = await orchestrator.requestChangesOnPhase(
           input.phaseId,
-          unresolved,
+          unresolvedThreads,
           input.summary,
         );
         return { success: true, taskId: result.taskId };