Bind review stamps to the session ticket

[TheMostlyGreat]

Summary

• Resolve write-review-stamp.ts against the session-bound active ticket before falling back to a global in_progress scan.
• Keep explicit --ticket behavior for manual disambiguation and stale/missing session bindings.
• Add integration coverage for multiple in_progress tickets with and without a session-bound ticket.
• Reuse the shared second-ticket fixture in the review-stamp tests.

Fixes #564.

Notes

Issue #564 also mentioned record-skill-invocation.ts, but current code does not scan tickets there. The reproducible failing path is write-review-stamp.ts, which this PR fixes.

Verification

• SAFEWORD_TEST_LOCK_DIR=/tmp/safeword-8935-review-stamp-test.lock bun run test tests/integration/review-stamp.test.ts
• bun run typecheck
• bunx eslint packages/cli/tests/integration/review-stamp.test.ts
• git diff --check origin/main...HEAD
• cmp -s packages/cli/templates/hooks/write-review-stamp.ts .safeword/hooks/write-review-stamp.ts
• bun audit --json