review classifier: a setting makes the PR review list only the failed rules

failures_only (off by default, also for a stored document without it) makes the
review the classifier posts on a PR list just the rows that failed their rule,
or say that no check failed on an approval. A review with no clean verdict and
a try-out keep every row. The classifier settings form gets a checkbox for it.

docs/2-handbook/swarm/ui.md

@@ -297,7 +297,10 @@ a repo admin adds it as a collaborator with write access
 
 The **classifier settings** section shows the runtime, model and
 effort the [review classifier](../../4-implementation/swarm/review-classifier.md) runs with and how many
-requested reviews run at once, and lets you change them. The runtime is **API
+requested reviews run at once, and lets you change them. The **PR reviews list
+only failed rules** checkbox makes the review the classifier posts on a PR leave
+out the rules that passed or didn't apply; try-outs always show every rule. The
+runtime is **API
 key** (claude on the Anthropic key) or **ACP** (opencode on a provider). On the
 API key runtime the model is free text, one word as claude's `--model` takes
 it, such as `haiku` or `sonnet`. Choosing ACP shows the provider's fields in

docs/4-implementation/swarm/review-classifier.md

@@ -216,6 +216,7 @@ replaces it.
   "effort": null,
   "max_concurrent_reviews": 2,
   "max_classifications": 10,
+  "failures_only": false,
   "runtime": "api-key",
   "acp": null
 }
@@ -238,6 +239,11 @@ replaces it.
   three minutes, so the controller waits a minute plus three per
   classification for the reply (31 minutes for ten), and the classifier may
   answer for as long as the biggest run the limit allows
+- `failures_only`: a boolean, `false` by default (also for a document stored
+  before the field existed). When `true`, a posted PR review lists only the
+  rows that failed their rule, the ones that make it ask for changes, and an
+  approval says `No check failed.` in place of the table. A review with no
+  verdict, and a try-out, always show every row
 - `runtime`: `api-key` or `acp` (see [Runtimes](#runtimes))
 - `acp`: the provider the ACP runtime runs on, or `null`. It stays stored
   while the runtime is `api-key`, so switching back and forth needs no