feat: review all remote HolodoriDB changes before collection

data/holodoridb/README.md

@@ -1,6 +1,8 @@
 # HolodoriDB card data
 
-This directory is generated by `npm run data:sync`.
+First run `npm run data:sync` to review every remote change since the commits in manifest.json. The review includes every intervening commit, all files, JSON record/field before-and-after values, and full patches under data/holodoridb-review. Present a semantic summary to the user before calculator extraction. Review does not advance the collection baseline.
+
+This directory is then generated by `npm run data:apply`. Collectors reject remote commits that do not match the review report.
 
 - `manifest.json`: source commits, master-data version, checksums, and validation counts
 - `card-master.json`: lossless copies of the card-related master tables and Korean/English/Japanese localization tables
@@ -9,6 +11,6 @@ This directory is generated by `npm run data:sync`.
 
 The collection script also creates `src/lib/data/cards-summary.json`, a small Korean-only projection used by the card list page.
 
-The ignored source clones are cached under `data/raw/holodoridb` so a later sync only needs to fetch changes.
+All HolodoriDB collectors fetch the official remote `main` before reading data. A bare object cache under `data/raw/holodoridb-remote` only accelerates fetching; reads are pinned to the fetched commit, never checkout files. Remote failures stop collection, and `--offline` is rejected. Song metadata and titles come from `Music.json` and `LangMusic_Kor.json` in the Korean remote repository.
 
 Binary assets such as card illustrations, movies, and voices are not collected. The source repositories did not contain a license file at the recorded commits, so redistribution terms must be confirmed before publishing the generated data as part of a public service.