CI-check flow, repo-creation safety, and dev-start/dev-complete refactors

[vkryzhanovskyi-1544]

Summary

Adds an automated CI-check flow for pull requests, hardens the plugin against
ever creating a repository, and refactors the dev-start / dev-complete guidance
for clarity and DRY. Docs + JS only — no Salesforce metadata, no org needed.

What's included (by area)

• feat(dev-check) — new /dev-check skill + shared references/ci-flow.md
  (single source of truth): watch a PR's checks, auto-fix small mechanical
  failures (lint + self-inflicted build/deploy, incl. the single-sandbox
  cross-branch case), escalate the rest into a note on the PR. dev-complete
  Step 7 runs the same flow inline after opening a PR.
• feat(dev-complete) — references/pr-description.md: PR bodies are now a
  developer-facing analysis grounded in the actual diff, with a mandatory
  LWC-vs-non-LWC breakdown (fixes Apex changes being mislabelled "LWC only").
• refactor(dev-start) — clearer "fresh setup per feature" rule (the new-vs-
  continued-feature boundary is the user's call, not automatic); deploy guidance
  extracted into references/deploy.md to keep SKILL.md lean.
• fix(security) — see below.
• test — tests/check_integrity.py (references resolve, frontmatter valid,
  JS compiles) and tests/test_permissions.js (safe allowlist merge + deny
  guards). Offline, non-zero exit on failure.
• chore — bump plugin version to 0.2.0.

Notable behavior changes — reviewer, look here

• Security (incident-driven): the plugin once created a brand-new repo,
  populated main, and opened a PR to it. Now gh repo create/delete/…,
  gh api … POST, and git init are hard-denied; gh repo is narrowed to
  list/view/clone; the blanket gh api is dropped; and Step 3 carries an
  explicit "never create a repository" rule. Deny overrides allow, so users who
  still carry a broad gh repo * from an earlier version are protected too.
• Permissions: git push, gh pr create, gh pr edit, the read-only CI
  commands (gh pr/run), and git diff are now pre-approved so the build-and-
  ship flow runs prompt-free; the ASK list is emptied.
• Automation: dev-check will commit and push small CI fixes on its own
  (bounded: ≤2 rounds, no force-push, feature branch only).