add review type (perf, bug, security, ...) + fix tests

README.md

@@ -51,11 +51,20 @@ Herald reviews pull requests inside an ephemeral
    `GITEA_TOKEN` (so private repositories work), tells the model which files and
    lines changed — additions and deletions, with the line numbers of the new and
    old versions of the file respectively — then lets it explore the repository
-   with read-only tools (`ls`, `read_file`, `grep`, `find`) run inside the
-   container: the code itself is not sent, so the model reads it at those lines,
+   with read-only tools (`ls`, `file_size`, `read_file`, `grep`, `find`) run inside
+   the container: the code itself is not sent, so the model reads it at those lines,
 4. posts the review, anchoring each comment on the added or removed line it
    refers to, and removes the container and the temporary clone.
 
+Generated files are left out of the changes handed to the model: lockfiles
+(`Cargo.lock`, `package-lock.json`, `yarn.lock`, `go.sum`…) are machine-written
+dependency churn whose thousands of lines would drown the code under review, and
+they are never a place where a comment belongs.
+
+Each comment is tagged with a severity — `bug`, `security`, `performance` or
+`maintainability` — shown at the start of the comment, and the summary also lists
+what the pull request does well.
+
 Herald drives the container daemon through its socket: `DOCKER_HOST` (default
 `unix:///var/run/docker.sock`), which covers both docker and podman's
 Docker-compatible socket. The repository must contain a