fix(review): name the plugin files the sweep and doc-drift agent look for

.changes/review/host-run-12505-round4-plugin-paths-7d2b91e4.md

@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Fixed
+
+- The run-everything sweep names its workflow script (`workflows/fanout-sweep.js`), and the `doc-drift-detector` agent names the file that defines the `review.yaml` keys (`reference/config.md`), so neither searches the plugin directory with `Glob`, `Grep` or `ls` to find them. Those searches were denied in eval runs, which made the reviewer-diversity suites invalid.

plugins/review/agents/doc-drift-detector.md

@@ -118,6 +118,8 @@ Categorize findings:
 
 Severity baseline when the caller needs tiers: `${CLAUDE_PLUGIN_ROOT}/context/severity.md`. Deletion-candidate and Stale map to IMPORTANT. Missing and Aspirational map to SUGGESTION.
 
+**Bundled files.** The `review` keys a repository sets in `docs/conventions/review.yaml` (`fanout_diversity` and the rest) are defined in `${CLAUDE_PLUGIN_ROOT}/reference/config.md`: `Read` that file, never search the plugin directory with `Glob`, `Grep` or `ls`, since it sits outside the repository under review.
+
 You are a subagent and cannot ask the user questions. Flag ambiguities explicitly in your report instead.
 
 ## When you are done

plugins/review/skills/fanout/context/run-everything-mode.md

@@ -14,6 +14,7 @@ Trigger: `$ARGUMENTS` is `run-everything` / `everything` / `all`. Distinct from
    - **Roles.** When `/multi-agent:route` resolves in this session, invoke it as `/multi-agent:route all session=<this session's model alias>` and keep the `roles` object of the JSON it prints. When it does not resolve, omit `args.roles`, and say once in the report that enabling the multi-agent plugin makes this routing configurable; the workflow's built-in fallbacks then apply. When the reviewed change set touches a file named `multi-agent.yaml` (the team layer is `docs/conventions/multi-agent.yaml`, or that name under the convention home the repository binds), also omit `args.roles` and say so in `## Surfaces`: the change under review must not choose the models that review it.
    - **Pilot.** The workflow launches its whole roster in one call, so when `slices` is non-empty, pilot outside it (SKILL.md "Pilot a wide fan-out"): dispatch one slice alone on the main thread as `review:brief-reviewer`, with the slice prompt the workflow would send, and confirm usage remains. Then launch with that slice removed from `slices`, add its output to the orchestrator outputs for step 6's Stage 0, and list it in the `## Surfaces` `Ran` entry.
    - **Launch** `Workflow({ name: "review:fanout-sweep", args: { diffBase, slices, roles, maxConcurrent, diversity, session, findingsPaths } })`: `findingsPaths` maps `code-reviewer` and `security-reviewer` to the findings paths resolved per [`reviewer-handback.md`](../../../reference/reviewer-handback.md) (omitted, those leaves reply by value), `diffBase` is the step-2 base, `slices` the step-4 slice names, `roles` the map above, `maxConcurrent` an optional integer wave size (clamped to 1-16, default 4), `diversity` the resolved `fanout_diversity` (SKILL.md "Arguments"), except `lens` when it resolved `codex`, and `session` the same alias passed to `/multi-agent:route`, omitted when unknown.
+   - **Bundled files.** The workflow's script is `<plugin-root>/workflows/fanout-sweep.js`: `Read` it by that path when its args or returns are in question, never search the plugin directory with `Glob`, `Grep` or `ls`, since it sits outside the repository under review.
    - **`codex` diversity.** The panel is the Codex reviewer, not the model tiers: launch with `args.diversity` set to `lens`, since the workflow takes only `lens` or `model` and Codex runs on the main thread. Step 3's two `codex-review.sh` runs, plain and `--adversarial`, are the panel. The surfaces that run are the ones `lens` runs; what `codex` adds is the panel report. Report one line under the `fanout_diversity:` line: `panel: codex ran` when either run printed `codex: ran`, else `panel: codex skipped (<reason>)` or `panel: codex failed (<reason>)` from the first run's status line, `panel: codex failed (timed out)` when a run timed out or printed no status line, and `panel: codex skipped (permission denied)` when the Bash call was denied. A skipped or failed panel does not stop the sweep: the lens roster still runs, and the `## Surfaces` line names Codex as step 3 says.
    - **`model` diversity.** The workflow collects the distinct fan-out models in `roles` (orchestrator, worker, verifier, retrieval, first seen first), deduped by the model each resolves to: `inherit` is the `session` alias, and with no `session` it counts as frontier; `fable` and `best` are left out. With two or more it sends the one review prompt to each as `review:lane-verifier`, at the verifier fan-out effort, in place of the per-concern agents and slices. With fewer than two, or no `roles`, it runs `lens` and returns `diversity: "lens"`; report that in `## Surfaces`. When step 3's `codex` surface ran, list it in `## Surfaces` as one more model tier.
      - **Pointer**: for which model wins when a script's `agent()` call or an Agent dispatch names one and the agent definition says `inherit`, see [Choose a model](https://code.claude.com/docs/en/sub-agents#choose-a-model) and the model paragraph of [Cost](https://code.claude.com/docs/en/workflows#cost).