[Change] Code review AI bloat detection

[djm81]

Summary

SpecFact's existing code-review surface enforces clean-code via the principle categories naming | kiss | yagni | dry | solid | clean_code | architecture through semgrep, ruff, pylint, radon, and AST runners. Those categories catch size and structure problems but do not target the shape of AI-generated code bloat: 20-line hand-rolled re-implementations of single stdlib calls, identity try/except, single-call passthrough wrappers, speculative Optional[T] = None plumbing, redundant intermediates, long-but-linear functions, etc.

This change introduces ai_bloat as a sixth principle category alongside the existing six, with its own packaged semgrep rule pack, an AST runner for semantic detectors, a parallel policy pack, and an IDE slash-command prompt (/specfact.08-simplify) that walks the user through targeted rewrites with per-change confirmation. Findings are advisory-only and never block commits.

Change

OpenSpec change: openspec/changes/code-review-ai-bloat-detection/

Scope

• packages/specfact-code-review — new semgrep rule pack resources/semgrep-rules/ai-bloat.yaml, new AST runner tools/ai_bloat_runner.py, new policy pack resources/policy-packs/specfact/ai-bloat-patterns.yaml, SEMGREP_RULE_CATEGORY extension, manifest version bump
• packages/specfact-project — new prompt resource resources/prompts/specfact.08-simplify.md, manifest version bump

Capabilities

• New: code-review-ai-bloat-detection
• Modified: clean-code-policy-pack (documentation only, to note the parallel ai-bloat pack)

Detectors

Pattern-shape (semgrep): ai-bloat.manual-loop-comprehension, ai-bloat.passthrough-lambda, ai-bloat.identity-try-except, ai-bloat.none-then-none, ai-bloat.single-call-wrapper.

Semantic (AST): ai-bloat.unused-optional-param, ai-bloat.dead-branch, ai-bloat.loc-vs-complexity, ai-bloat.redundant-intermediate.

Severity model

All ai_bloat findings emit at advisory severity. Pre-commit warns but never blocks — bloat is judgment, not correctness. Rewrites are LLM-mediated via the slash command with per-change human confirmation; the CLI never rewrites source files autonomously.

Parent Feature

Part of #175 — Modules Epic #162.