fix: add missing allowed-tools to 5 commands that need tool access

[xiaolai]

Automated audit: This PR was generated by NLPM, a natural language programming linter, running via claude-code-action. Please evaluate the diff on its merits.

Bug

Five commands declared no allowed-tools in their frontmatter. In Claude Code, a command with no allowed-tools cannot make any tool calls — all tool use is denied. This means each of these commands is broken: their described workflows silently fail at the first tool call.

Command	Missing tools	Impact
pr-review/commands/pr-review.md	Bash(git:*), Bash(gh:*), Read, Glob, Grep	Cannot read diff or fetch PR data
commit/commands/commit.md	Bash(git:*), Bash(npm:*), Bash(yarn:*), Bash(pnpm:*)	Cannot run pre-commit checks or execute git commit
create-pr/commands/create-pr.md	Bash(git:*), Bash(gh:*), Bash(biome:*), Read, Glob	Cannot create branch, format files, or open PR
documentation-generator/commands/documentation-generator.md	Read, Write, Edit, Glob, Grep	Cannot read any source files to generate docs
bug-fix/commands/bug-fix.md	Bash(git:*), Bash(gh:*), Read, Write, Edit, Glob, Grep	Cannot create issue, checkout branch, commit, or push

Fix

Added allowed-tools to each command's frontmatter, scoped to the tools their body actually requires:

• pr-review: reads git history and gh PR data, searches code
• commit: runs package manager lint/build scripts and git operations
• create-pr: git branch/commit/push, biome format, gh PR creation, reads files
• documentation-generator: reads source files, writes/edits documentation output
• bug-fix: git checkout/commit/push, gh issue/PR creation, reads and edits code

The tool lists are minimal — each entry is justified by a concrete operation described in the command body.

Impact

Without this fix, users invoking any of these commands get silent failures: the command body runs but all tool calls are rejected. With allowed-tools declared, the permissions contract is explicit and the commands can actually perform their described workflows.