feat(implement-loop): tier the quality review by independently-measured diff size

qual+repairs are the pipeline's largest cost pool (51M of 164.5M real
tokens, 31%, in the 206-run corpus), with opus weighing ~5x on the
quota side. The opus pin's own rationale (consequence-of-a-miss,
agent-template § model) scales with diff size — so the tier now does
too: the spec-reviewer, which runs before quality, reads the diff
itself and is independent of the implementer, reports diff_magnitude
(git diff HEAD --shortstat) and touches_contract; <=25 changed lines
and no contract-referenced path -> sonnet/high, anything larger,
contract-touching, or unmeasured -> opus/xhigh (fail conservative).
The independent end-verify/mini-verify suite gate is the
deterministic backstop that makes the lower tier defensible; the
chosen tier is logged per task (qual_tier) in the end-report.

Sampling phase per the issue's acceptance: the first ~10 real
small-diff iterations get a one-off opus second review; important+
divergences are recorded on the issue before the threshold counts as
proven.

closes #30

implement/SKILL.md

@@ -169,6 +169,16 @@ ground truth, never a self-report** — a self-report must never be able to
 The E2E phase's `status` is also read now (not just its fixtures): a
 non-`DONE` E2E status or a zero-fixture run surfaces as a concern.
 
+**Quality-tier selection** (issue #30). The quality phase runs
+opus/xhigh by default, tiered to sonnet/high for a small diff: ≤25
+changed lines AND no contract-referenced path, both measured by the
+spec-reviewer (which reads `git diff HEAD` itself — never the
+implementer's self-report) via `diff_magnitude` / `touches_contract`.
+Unmeasured or contract-touching diffs stay opus. The independent
+end-verify suite gate is the deterministic backstop; the chosen tier
+is logged per task in the end-report (`qual_tier`) so the split stays
+auditable.
+
 **Cross-task discard guard** (issue #23). In a multi-task run nothing
 commits between tasks, so one task's file-level `git checkout`/`git
 restore` can silently destroy an earlier task's DONE work in a shared