Add review-pr and review-open-prs skills

[henzigo]

What

Adds two project skills encoding the PR code-review workflow that was run against PRs #43–#51, so it is repeatable via /review-pr <N> and /review-open-prs:

• review-pr — the full single-PR protocol: read repo context first, scope the diff against the PR's (possibly stacked) base, chase PR-specific hypotheses instead of generic scanning, verify every finding (golden tests, helm unittest, kubeconform, upstream web research — never memory), post ONE GitHub review with diff-anchored inline comments and a severity-ranked summary, everything signed — Claude Agent (CR), and dedupe on re-runs.
• review-open-prs — orchestration only: discovers open PRs and their stack topology, fans out one parallel worktree-isolated agent per PR (each following review-pr), then verifies each review landed on the right PR, cleans up the agent worktrees, and produces a cross-PR severity summary. The protocol itself is not duplicated.

CLAUDE.md § Project Skills lists both.

Why

The review round on #43–#51 worked well (7 parallel reviews, findings from a high cert-manager HTTP01 block in #51 down to doc nits) but also hit non-obvious operational pitfalls worth institutionalizing:

• parallel agents share the session scratchpad — a generic payload.json gets overwritten by a sibling between write and POST (manifests as a 422 with the other PR's unresolvable paths/lines) → unique filenames + anchor re-verification right before POST, plus a mandatory post-hoc check that every review landed on the right PR;
• one bad inline anchor 422s the whole review → anchors must be cross-checked against gh pr diff hunks;
• worktrees with a PR branch checked out are not auto-removed → explicit cleanup step.

Notes

• Skills/docs only — no chart, template, or script changes; golden snapshots and unit tests unaffected.
• event: COMMENT only and "never resolve threads" kept consistent with the watch-pr skill.

🤖 Generated with Claude Code