refactor /review-pr into a reusable pr-review skill

[dceoy]

Summary

Fixes #32.

• Move the canonical PR review workflow from .opencode/commands/review-pr.md into a new OpenCode skill at .opencode/skills/pr-review/SKILL.md, so agents can load pr-review directly through the native skill tool.
• Reduce /review-pr to a thin wrapper that keeps agent: review-pr-orchestrator, forwards $ARGUMENTS as the requested review aspects, and instructs the agent to load and follow the pr-review skill; no workflow instructions are duplicated in the command.
• Allow the review-pr-orchestrator agent (whose permission block denies everything by default) to load only the pr-review skill (skill: { "*": deny, pr-review: allow }).
• All workflow behavior is preserved verbatim in the skill: App token preparation, PR-number resolution and local-mode fallback, headRefOid pinning with stale-head rejection, aspect-based reviewer selection, anchor validation, summary-only handling, batched submission through review-pr-submit.sh only, the exact no-findings result, and read-only simplify. The only text change is that the $ARGUMENTS placeholder (which OpenCode substitutes only in commands) became "supplied by the caller that loaded this skill".

Validation & docs

• validate-opencode.bats now scans both the command and the skill for agent references, checks the resolver allow-list path against the skill, and adds three tests: the command stays a thin wrapper (no helper-script or review-state references), the skill frontmatter declares name: pr-review plus a description, and the orchestrator permits the pr-review skill.
• Updated AGENTS.md and README.md to name the skill as the implementation source.

Notes

• In review-only mode the toolkit is copied to ~/.config/opencode/ and OPENCODE_DISABLE_PROJECT_CONFIG=1 is exported before the run, so the skill resolves from the trusted global config rather than the untrusted checkout, matching the existing handling for commands and agents.
• .agents/skills/local-qa/scripts/qa.sh passes: prettier/yamllint/shellcheck/zizmor/actionlint/checkov clean, all 50 bats tests green.

🤖 Generated with Claude Code

[dceoy]

One important issue remains: direct pr-review skill loading is advertised as supported, but it does not enter the action's review-only isolation path and therefore does not preserve the trusted-skill and read-only guarantees of /review-pr.

[dceoy]

important: The newly advertised direct-load path is not equivalent to /review-pr. action.yml enables the fresh global config, OPENCODE_DISABLE_PROJECT_CONFIG=1, and the deny-by-default review-pr-orchestrator only when the effective prompt starts with /review-pr. A prompt that merely asks an agent to load pr-review runs in normal mode, where project config remains enabled; OpenCode can therefore resolve a project-local skill with the same name instead of this trusted bundled skill, and execution uses the caller agent's broader permissions rather than the orchestrator's read-only boundary. Either route direct skill use through the same isolated/orchestrated path (with an end-to-end regression test), or scope this claim to trusted sessions where those guarantees are not promised.