settings: make mergeReviewProfiles pure (no in-place mutation)

mergeReviewProfiles mutated its base map in place before returning it. Today's callers tolerate it (base is always the freshly loaded settings map), but an in-place merge helper is a footgun. Build and return a new map, leaving both inputs untouched. Adds a test for purity + override precedence.