refactor(agent): clone the review snapshot once at the spawn chokepoint

Move the structural clone from the four call sites (auto review, codex
runtime, CLI /refine, gateway /refine) into AIAgent._spawn_background_review,
which every review path — immediate, idle-queue deferred, requeued — passes
through. Callers can no longer forget it, and the private helper is no longer
imported across hermes_cli/ and gateway/ package boundaries.

Tests now bind the real chokepoint (capturing at _spawn_background_review_now)
so they still fail if the clone is removed.

agent/turn_finalizer.py

@@ -819,14 +819,10 @@ def finalize_turn(
         and (_should_review_memory or _should_review_skills)
     ):
         try:
-            # The review fork sanitizes and repairs its private transcript in
-            # place.  A shallow list copy would leave the message dicts (and
-            # nested tool-call/content containers) shared with the live
-            # foreground transcript, allowing the review to mutate the
-            # representation that was just persisted and break prefix-cache
-            # parity on the next turn.
+            # _spawn_background_review clones the snapshot structurally so
+            # the fork's in-place sanitizers can't reach the live transcript.
             agent._spawn_background_review(
-                messages_snapshot=_clone_background_review_messages(messages),
+                messages_snapshot=list(messages),
                 review_memory=_should_review_memory,
                 review_skills=_should_review_skills,
             )