add skills code review agent

[March-77]

Summary

• add a validated code-review Skill with deterministic scripts and progressively loaded rule documentation
• parse unified diffs, file lists, and local Git workspace changes into file/hunk/added-line records
• detect security, async, resource-lifecycle, database-lifecycle, secret, and missing-test risks
• add confidence routing, file/line/category deduplication, and actionable structured findings
• add Filter-governed fake, Docker container, and explicit local-fallback runners with timeout, output, environment, network, filesystem, CPU, memory, and PID controls
• persist review tasks, sandbox runs, filter blocks, findings, monitoring, and final reports through a backend-neutral store with SQLite implementation
• redact credentials before audit, report, or database persistence and generate JSON/Markdown reports

Why

Automated code review needs a verifiable workflow around the model rather than unstructured comments alone. This prototype composes a reusable Skill, deterministic added-line analysis, pre-execution policy decisions, isolated checks, normalized findings, audit metrics, and queryable persistence. Sandbox failures are captured as partial results instead of aborting static review.

Production policy defaults to a network-disabled, read-only Docker workspace. Fake mode exercises the complete parser, Filter, sandbox, persistence, and reporting flow without API credentials; local execution is documented only as a development fallback.

Validation

• python -m pytest examples/skills_code_review_agent/test_code_review_agent.py -q (14 passed)
• python -m pytest tests/filter tests/storage examples/skills_code_review_agent/test_code_review_agent.py -q (282 passed)
• all eight required diff fixtures complete in fake mode
• real Docker 29.6.1 run passed with python:3.12-slim, network disabled, read-only mount, and resource limits
• quick_validate.py examples/skills_code_review_agent/skills/code-review (valid)
• python -m compileall -q examples/skills_code_review_agent
• design note is 463 characters

A broader Windows run of Skills and local CodeExecutor tests exposes existing POSIX-specific assumptions around file://C: parsing, Unix permission/path assertions, and overwrite-style rename. These failures do not execute the new example; the directly related Filter and Storage suites pass.

Closes #92

[github-actions]

CLA Assistant Lite bot:
Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@e113610). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             main        #174   +/-   ##
==========================================
  Coverage        ?   87.54280%           
==========================================
  Files           ?         467           
  Lines           ?       44103           
  Branches        ?           0           
==========================================
  Hits            ?       38609           
  Misses          ?        5494           
  Partials        ?           0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.