Deterministic config Review

A Review reads only what Warden already stores. It makes no network call and uses no LLM, so the same configuration always gives the same findings.

Workspace rules flag, for example, a destroy plan enabled on a PROD account, a Perm mode that lets anyone edit or delete, a repo path that does not fit its VCS provider, auto-apply on PROD, and a missing or old Terraform version.

Token rules flag PATs that never expire, have no scopes, can manage other tokens, can write without a resource restriction, or have gone unused. Webhook rules flag non-HTTPS or invalid URLs and endpoints with no or unknown events.