feat: implement Crosscheck Work experiment

Add the 'Crosscheck Work' experiment to the Agents settings. When enabled,
a reviewer sub-agent is spawned after the main agent finishes a turn (with
no pending tool calls). The reviewer critiques the output using a dedicated
system prompt focused on correctness, simplicity, and code quality. If the
reviewer does not respond with 'LGTM!', its feedback is injected as a
synthetic user query back to the main agent, which must address it. This
loop continues until the reviewer approves or max iterations is reached.

Components:
- Feature flag: CrosscheckWork (enabled in DOGFOOD_FLAGS)
- Settings: agents.experiments.crosscheck_enabled,
  agents.experiments.crosscheck_model_id,
  agents.experiments.crosscheck_max_iterations
- Settings UI: new 'Experiments' subpage under Agents
- Crosscheck module: app/src/ai/crosscheck/ with prompt, reviewer model
- Controller integration: hooks into AfterStreamFinished when no actions
  are queued, triggers reviewer, handles feedback injection
- Provider support: OpenAI-compatible and Bedrock direct invocation
- Safety: max iteration guard, error handling, reset on new user query

crates/galaxy_features/src/lib.rs

@@ -910,6 +910,12 @@ pub enum FeatureFlag {
     LspCompletion,
     LspRename,
     LspSignatureHelp,
+
+    /// Enables the "Crosscheck Work" experiment, which spawns a reviewer
+    /// sub-agent after the main agent finishes a turn. The reviewer critiques
+    /// the output and sends feedback back to the main agent until it responds
+    /// with "LGTM!".
+    CrosscheckWork,
 }
 
 static FLAG_STATES: [AtomicBool; cardinality::<FeatureFlag>()] =
@@ -981,6 +987,7 @@ pub const DOGFOOD_FLAGS: &[FeatureFlag] = &[
     FeatureFlag::ContextWindowUsageBreakdown,
     FeatureFlag::CloudRunners,
     FeatureFlag::WaitForEventsParentRegistration,
+    FeatureFlag::CrosscheckWork,
 ];
 
 /// Features enabled for feature preview build users (e.g.: Friends of Warp).