Fix audit tool bootstrap and add per-run preflight

audit-code install-tools.sh:
- Buffer the opengrep release JSON before grep -m1; curl died with (23)
  under pipefail when grep quit early.
- Use ${m}: in the PowerShell block; $m: parsed as a scope-qualified var.
- On Arch, skip paru/yay when pacman -Q shows every package installed,
  since --needed still invokes sudo.
- Add --check-only (fast, installs nothing, non-zero naming missing tools)
  and --user-only (no system package managers, no sudo).

log-run.py (both skills): put the skill dir on sys.path so running it as
a script from any cwd no longer raises ModuleNotFoundError.

audit-terraform: move deps from requirements.txt into pyproject
dependency groups and add scripts/install-tools.sh (uv sync --group tools,
then check trivy, tflint, tofu, terragrunt, gh).

Both SKILL.md files gain a 0.5 Preflight step and call scripts through
uv run --project ${SKILL_DIR}. tools_unavailable is now a map of tool to
exact install command; audit-terraform skips trivy when absent and stops
with an install hint instead of crashing when tofu/terragrunt is missing.

plugins/reviews/skills/audit-code/README.md

@@ -129,7 +129,9 @@ clean result.
 ### Installing them
 
 ```
-scripts/install-tools.sh
+scripts/install-tools.sh               # everything, including system packages
+scripts/install-tools.sh --user-only   # skip brew/pacman/apt (no sudo)
+scripts/install-tools.sh --check-only  # install nothing; non-zero if anything is missing
 ```
 
 What it does:
@@ -220,7 +222,7 @@ Runs are logged by a single call after the fan-out completes:
 
 ```
 echo '{"walkthrough-reviewer": {"model":"sonnet","input_tokens":N,"output_tokens":N,"duration_ms":N}, ...}' \
-  | python ${SKILL_DIR}/scripts/log-run.py \
+  | uv run --project ${SKILL_DIR} python ${SKILL_DIR}/scripts/log-run.py \
       --output-dir <OUTPUT> --run-id <hex> --repo <REPO> \
       --mode <local|ref> --usage-json -
 ```