Fix audit tool bootstrap and add per-run preflight

audit-code install-tools.sh:
- Buffer the opengrep release JSON before grep -m1; curl died with (23)
  under pipefail when grep quit early.
- Use ${m}: in the PowerShell block; $m: parsed as a scope-qualified var.
- On Arch, skip paru/yay when pacman -Q shows every package installed,
  since --needed still invokes sudo.
- Add --check-only (fast, installs nothing, non-zero naming missing tools)
  and --user-only (no system package managers, no sudo).

log-run.py (both skills): put the skill dir on sys.path so running it as
a script from any cwd no longer raises ModuleNotFoundError.

audit-terraform: move deps from requirements.txt into pyproject
dependency groups and add scripts/install-tools.sh (uv sync --group tools,
then check trivy, tflint, tofu, terragrunt, gh).

Both SKILL.md files gain a 0.5 Preflight step and call scripts through
uv run --project ${SKILL_DIR}. tools_unavailable is now a map of tool to
exact install command; audit-terraform skips trivy when absent and stops
with an install hint instead of crashing when tofu/terragrunt is missing.

plugins/reviews/skills/audit-terraform/tests/test_controls_schema.py

@@ -1,5 +1,5 @@
 import json
-from datetime import datetime, timezone
+from datetime import datetime, timezone, UTC
 
 from scripts.controls_schema import Control, ControlsFile
 
@@ -24,7 +24,7 @@ def test_controls_file_serializes_with_resource_type_index():
     )
     cf = ControlsFile(
         source="fsbp",
-        fetched_at=datetime(2026, 5, 12, 9, 0, 0, tzinfo=timezone.utc),
+        fetched_at=datetime(2026, 5, 12, 9, 0, 0, tzinfo=UTC),
         controls=[a, b],
     )
     payload = json.loads(cf.to_json())
@@ -50,7 +50,7 @@ def test_control_appears_under_every_resource_type():
     )
     cf = ControlsFile(
         source="fsbp",
-        fetched_at=datetime(2026, 5, 12, tzinfo=timezone.utc),
+        fetched_at=datetime(2026, 5, 12, tzinfo=UTC),
         controls=[c],
     )
     payload = json.loads(cf.to_json())