Add review_pause() — OHIOD log review gate between tiers

After each tier completes, grep the tier log for WARN/ERROR lines and
display them. If issues are found, block until the OHIOD confirms they
have reviewed before the next tier begins. Clean runs auto-continue.

Not bypassed by CE_INSTALL_NO_CONFIRM — this is a safety gate, not a
convenience prompt. Fires whether tiers are run standalone or from the
full-stack orchestrator.

Suggested by DT.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ce-base.sh

@@ -72,5 +72,6 @@ confirm_proceed
 phase_install
 phase_verify
 print_summary
+review_pause "Tier 0 — Base" "${LOG_FILE}"
 
 log_info "=== TIER 0 COMPLETE ==="

ce-basic.sh

@@ -79,5 +79,6 @@ confirm_proceed
 phase_install
 phase_verify
 print_summary
+review_pause "Tier 2 — Basic" "${LOG_FILE}"
 
 log_info "=== TIER 2 COMPLETE ==="

ce-minimal.sh

@@ -85,5 +85,6 @@ confirm_proceed
 phase_install
 phase_verify
 print_summary
+review_pause "Tier 1 — Minimal" "${LOG_FILE}"
 
 log_info "=== TIER 1 COMPLETE ==="

lib/ce-common.sh

@@ -149,3 +149,29 @@ print_summary() {
         done
     fi
 }
+
+# review_pause <label> [log_file]
+# Greps the tier log for WARN/ERROR lines and displays them.
+# If issues found: blocks until OHIOD confirms reviewed.
+# If clean: logs OK and continues without prompting.
+# Not bypassed by CE_INSTALL_NO_CONFIRM — this is an OHIOD safety gate.
+review_pause() {
+    local label="${1:-this step}"
+    local log="${2:-${LOG_FILE}}"
+    local issues
+
+    issues="$(grep -E '\[(WARN |ERROR)\]' "${log}" 2>/dev/null || true)"
+
+    echo ""
+    if [[ -n "${issues}" ]]; then
+        log_warn "=== REVIEW REQUIRED — ${label} ==="
+        echo ""
+        echo "${issues}"
+        echo ""
+        read -r -p "Address any issues above. Ready to proceed? [y/N] " confirm
+        [[ "${confirm,,}" == "y" ]] \
+            || { log_info "Stopped at ${label} — address issues and re-run from this tier."; exit 0; }
+    else
+        log_info "${label} — no issues found, continuing."
+    fi
+}