request the review classifier's review when a PR's head moves

The router gets a request_reviewer node and a pull_request_sync source;
the built-in head-classifier flow asks swarm-controller, over
$SWARM.router.sink.request-reviewer, to request review-classifier on
every push, unless its review of the head already stands. The controller
subscribes to pull_request_sync on its pull-request hook and answers
the router; nats-auth grants the router the publish and the controller
the subscribe.

docs/swarm/README.md

@@ -32,7 +32,8 @@ grafana, the controller, authelia, …) →
   its repo's own yes/no rules and posts the result as a review. →
   [`review-classifier.md`](review-classifier.md)
 - **notification router** — forge events turned into todos on the agents
-  they concern: assigned, unassigned, cleared on close. →
+  they concern: assigned, unassigned, cleared on close; and the classifier's
+  review requested on a push. →
   [`notify-router.md`](notify-router.md)
 - **swarm UI** — the operator's day-to-day surface, on the swarm apex,
   `admins` only. → [`ui.md`](ui.md)
@@ -415,7 +416,7 @@ itself, all under `https://<swarm.domain>/webhook/forge/`:
 - an instance-wide `pull_request_review_request` system hook, which starts
   the [review classifier](review-classifier.md#trigger-and-lifecycle)
 - instance-wide `issues` + `issue_assign` and `pull_request` +
-  `pull_request_assign` system hooks, whose deliveries it
+  `pull_request_assign` + `pull_request_sync` system hooks, whose deliveries it
   keeps in the `SWARM_EVENTS` stream for the
   [notification router](notify-router.md#the-path)