feat(skills): add portable review workflows

[jordangarrison]

Summary

• Add portable multi-agent-pr-review, browser-testing-walkthrough, sre-review, sre-review-worktrees, and sre-review-rollover skills using the standard Agent Skills layout.
• Move detailed prompts and procedures into references/, add OpenAI agent metadata, and make repository installs discoverable through npx skills add.
• Bump the Claude plugin to 0.6.1, document installation, and guard legacy Slack runtime state from Git.

Behavior

• Generic PR review prefers GitHub connector metadata, uses native subagents in capacity-bounded waves, permits Herdr only through explicit/confirmed fallback, and requires a complete per-PR preview before posting.
• multi-agent-pr-review --skip-user-confirmation authorizes posting after that preview without pausing for final GitHub posting sign-off. It does not reduce technical validation, waive other action approvals, skip inline-anchor or state/head checks, or authorize any unrelated action.
• Reviewers retain the original focused-check and official-documentation validation behavior while receiving immutable PR context. A moved head discards all reports and restarts review and consolidation.
• Browser walkthroughs use a per-command agent-browser launcher, record WebM and screenshots, and provide a portable WebM-to-GIF script with an ffmpeg/Nix fallback.
• SRE workflows preserve approved Flocasts channel/reaction conventions while moving runtime state under the XDG cache and supporting FLOCASTS_DEV_ROOT.
• Worktree preparation binds detached worktrees to exact PR head SHAs and never copies environment files into fork or otherwise untrusted PR worktrees.

Review follow-up

• Quote SRE frontmatter descriptions so #infra-private survives YAML parsing and skill discovery.
• Preserve the authorized GitHub review verdict in the API fallback, with explicit self-authored-PR handling.
• Make SRE companion thread/cache rules self-contained and narrow legacy runtime ignores to exact paths.
• Improve stale-head recovery, reviewer capacity, exact-SHA worktrees, environment-file handling, and browser invocation portability.
• Preserve the original technical-validation workflow rather than introducing new validation modes.

Validation

• quick_validate.py passed for all five skills using Nix Python/PyYAML.
• npx skills add <local-repo> --list --full-depth discovered all five skills with complete descriptions.
• claude plugin validate --strict . passed.
• bun test passed: 10 tests.
• nix flake check passed.
• ShellCheck and bash -n passed for the browser scripts; the launcher resolved agent-browser 0.33.0.
• Browser smoke testing recorded WebM, captured a screenshot, and converted the recording to GIF.
• An isolated Git fixture verified detached worktree HEAD equality with the expected PR SHA.
• Gitleaks found no secrets in the skill tree.
• Native multi-agent reviews were previewed without posting; their feedback was incorporated or deliberately rolled back where it changed the original validation contract.

Rollout

No global installation or runtime-state migration is included. Those steps remain post-merge work.