Fix audit tool bootstrap and add per-run preflight

audit-code install-tools.sh:
- Buffer the opengrep release JSON before grep -m1; curl died with (23)
  under pipefail when grep quit early.
- Use ${m}: in the PowerShell block; $m: parsed as a scope-qualified var.
- On Arch, skip paru/yay when pacman -Q shows every package installed,
  since --needed still invokes sudo.
- Add --check-only (fast, installs nothing, non-zero naming missing tools)
  and --user-only (no system package managers, no sudo).

log-run.py (both skills): put the skill dir on sys.path so running it as
a script from any cwd no longer raises ModuleNotFoundError.

audit-terraform: move deps from requirements.txt into pyproject
dependency groups and add scripts/install-tools.sh (uv sync --group tools,
then check trivy, tflint, tofu, terragrunt, gh).

Both SKILL.md files gain a 0.5 Preflight step and call scripts through
uv run --project ${SKILL_DIR}. tools_unavailable is now a map of tool to
exact install command; audit-terraform skips trivy when absent and stops
with an install hint instead of crashing when tofu/terragrunt is missing.

plugins/reviews/skills/audit-code/scripts/manifest.py

@@ -124,7 +124,7 @@ class Manifest:
     findings: list[Finding]
     package_diffs: dict[str, PackageDiff]
     tool_stats: dict[str, ToolStat]
-    tools_unavailable: list[str]
+    tools_unavailable: dict[str, str]
     errors: list[str]
 
     def to_dict(self) -> dict:
@@ -138,7 +138,7 @@ class Manifest:
             "findings": [f.to_dict() for f in self.findings],
             "package_diffs": {k: v.to_dict() for k, v in self.package_diffs.items()},
             "tool_stats": {k: v.to_dict() for k, v in self.tool_stats.items()},
-            "tools_unavailable": list(self.tools_unavailable),
+            "tools_unavailable": dict(self.tools_unavailable),
             "errors": list(self.errors),
         }