Fix audit tool bootstrap and add per-run preflight

audit-code install-tools.sh:
- Buffer the opengrep release JSON before grep -m1; curl died with (23)
  under pipefail when grep quit early.
- Use ${m}: in the PowerShell block; $m: parsed as a scope-qualified var.
- On Arch, skip paru/yay when pacman -Q shows every package installed,
  since --needed still invokes sudo.
- Add --check-only (fast, installs nothing, non-zero naming missing tools)
  and --user-only (no system package managers, no sudo).

log-run.py (both skills): put the skill dir on sys.path so running it as
a script from any cwd no longer raises ModuleNotFoundError.

audit-terraform: move deps from requirements.txt into pyproject
dependency groups and add scripts/install-tools.sh (uv sync --group tools,
then check trivy, tflint, tofu, terragrunt, gh).

Both SKILL.md files gain a 0.5 Preflight step and call scripts through
uv run --project ${SKILL_DIR}. tools_unavailable is now a map of tool to
exact install command; audit-terraform skips trivy when absent and stops
with an install hint instead of crashing when tofu/terragrunt is missing.

plugins/reviews/skills/audit-terraform/scripts/manifest.py

@@ -162,6 +162,7 @@ class Manifest:
     module_graph: dict[str, ModuleGraphEntry]
     errors: list[str]
     tflint_findings: list[TflintFinding] = field(default_factory=list)
+    tools_unavailable: dict[str, str] = field(default_factory=dict)
 
     def to_dict(self) -> dict:
         return {
@@ -176,6 +177,7 @@ class Manifest:
             "tflint_findings": [f.to_dict() for f in self.tflint_findings],
             "module_graph": {k: v.to_dict() for k, v in self.module_graph.items()},
             "errors": list(self.errors),
+            "tools_unavailable": dict(self.tools_unavailable),
         }
 
     def to_json(self, indent: int = 2) -> str: