Summary comment: clearer fresh-publish blocks, readable package names, no duplicate inline comments #32

On operationcode-pybot#466 the gate was right (3 dependencies published under 72 hours ago, a hard block by design), but the summary comment made it harder than it should be to see what was wrong and what to do about it.

What I saw

1. Wrong next step for a fresh-publish block. The CAUTION box says "fix the cause named in the row, then push". For a fresh-publish block there is nothing to fix. The author either waits until the youngest package is 72 hours old and starts a new run (push, or close and reopen), or pins older versions. The text is generic (review/src/oc_review/publish.py, the CAUTION/next-step builder near line 1662).
2. The package name is hard to pick out. Each row reads "Recently published dependency: published 68.2 hours ago (under 72), in poetry.lock, coverage@​7.17.2". The package is the last thing in the row, after the age and the file (which is already in the Where column), and the escaping makes it worse. The CAUTION headline ("Recently published dependency and 2 other hard block(s)") names no package at all.
3. Duplicate inline comment. poetry.lock:1405 got two near-identical supply-chain comments, one from each run. The model reworded the title between runs ("sentry-sdk runtime dependency bumped to a release under 72 hours old" vs "Runtime dependency sentry-sdk bumped to a release under 72h old"), and the cross-run dedupe key includes the title, so the second one was treated as new.
4. The supply-chain finding only restates the hard block. It is the same fact in the same file, so it adds noise to a comment that already blocks on it.

What I'd like

• For a fresh-publish-only block, the next step names the time it clears: "wait until 2026-11-08 18:52 UTC, then push or close and reopen (or pin older versions)". Other hard blocks keep the "fix and push" text.
• Package first in each row, for example "sentry-sdk 2.74.0 published 49 hours ago (needs 72)". Name the packages in the CAUTION headline when there are only a few. Round ages to whole hours, and trim the published timestamps in the dependency list to the minute.
• A cross-run inline key that does not depend on model-written text (for example file, side, line and category), or drop supply-chain findings that only restate a prefilter hard block.
• Keep the escaping that protects the comment from injected markdown, but check that it does not make package names unreadable.

Comment and spec text (docs/claude-review-design.md) change together. This is display only: no change to the gate, the 72-hour rule or what blocks.