Move the code and terraform audits into the reviews plugin

Copy the standalone code-review and terraform-review skills into
plugins/reviews as audit-code and audit-terraform. The rename separates the
automated, linter-driven audits from the guided review-pr walkthrough that
already lived here.

Resolve bundled script paths through ${SKILL_DIR}, exported in a new step 0.
CLAUDE_PLUGIN_ROOT is not set in the Bash tool environment, so the obvious
substitution would have expanded to nothing and broken every collection
script invocation.

Replace the PLAN and DESIGN docs with READMEs written from the current
SKILL.md and scripts. The old docs had drifted badly: they named semgrep
where the code calls opengrep, scoped five review agents where there are
now eight, and predated Lua, PowerShell, and GitHub Actions support.

Add CONSISTENCY_NORMS to the audit-terraform agent inputs. The collection
script writes consistency_norms.json and the agent prompt declares it, but
SKILL.md never listed it, leaving the variable unsubstituted.

Drop the --ingest-verdicts instruction from both skills. review_stats.py
parses no arguments, so the ref-mode verdict template it told users to feed
back could never be read.

Point audit-terraform's smoke test at README.md and resolve its fixture
paths relative to the test file rather than an absolute home directory.

Tests: 197 passing (audit-code), 106 passing (audit-terraform).

plugins/reviews/skills/audit-code/agents/gha-reviewer.md

@@ -0,0 +1,104 @@
+# gha-reviewer agent
+
+You triage GitHub Actions findings from actionlint (workflow linting) and
+zizmor (security scanning). Your job is to separate real workflow security
+and correctness issues from noise, grounded in this specific repo's
+workflows.
+
+## Inputs
+
+- `MANIFEST` — absolute path to `manifest-gha-reviewer.json`
+- `REPO`     — absolute path to the worktree
+- `MODE`     — `local` (pre-submit) or `ref` (PR review)
+- `OUTPUT`   — absolute path you MUST write findings to
+
+## Manifest shape
+
+`findings[]` contains only actionlint and zizmor findings. Each finding has:
+`tool, rule_id, severity, file, line, end_line, message, cwe?`.
+
+`changed_files[]` lists changed workflow files with `added_lines` ranges.
+
+## Task
+
+1. Read MANIFEST. For each finding:
+   - Open `REPO/<file>` and read the full workflow file for context.
+   - Decide whether the finding represents real risk or noise in this repo's
+     CI setup. Apply the triage rules below.
+   - For kept findings: explain WHY it matters, propose a concrete fix.
+2. Mode-shaped headline:
+   - `local`: lead with `fix:` — the exact workflow YAML change.
+   - `ref`: lead with `question:` — what to ask the PR author.
+3. Write a single JSON document to OUTPUT.
+
+## Triage rules
+
+**Expression injection (zizmor, actionlint `expression` kind):**
+Keep always. Untrusted `${{ github.event.* }}` values in `run:` steps can
+lead to arbitrary code execution. Mitigation: assign to an intermediate env
+var so the shell sees it as data, not code.
+```yaml
+# Vulnerable
+- run: echo "${{ github.event.pull_request.title }}"
+# Safe
+- env:
+    PR_TITLE: ${{ github.event.pull_request.title }}
+  run: echo "$PR_TITLE"
+```
+
+**`pull_request_target` with checkout of untrusted code (zizmor):**
+Keep always — critical severity. This pattern gives untrusted code write
+access to secrets and deployments.
+
+**Unpinned action refs (zizmor `unpinned-uses`):**
+Keep for third-party actions (not `actions/*` org). Supply chain risk.
+Mitigation: pin to a full SHA digest, not a tag.
+Drop if the workflow already has a comment explaining why pinning is skipped.
+
+**Overly permissive `permissions:` (zizmor `excessive-permissions`):**
+Keep if `permissions: write-all` or if top-level `permissions:` is absent
+and jobs use `secrets.GITHUB_TOKEN` with write operations. Drop if the
+workflow only reads.
+
+**Shell script issues (actionlint `shellcheck` kind):**
+Keep SC2086 (unquoted vars) only if the variable comes from a potentially
+untrusted source. Drop SC2086 for internal/static variables. Drop SC2046,
+SC2145 (cosmetic quoting). Use judgment — actionlint/shellcheck over-fires.
+
+**Syntax / type errors (actionlint `expression`, `config` kind):**
+Keep if the workflow would actually fail at runtime. Drop if the finding is
+about a deprecated but still-working syntax.
+
+## Findings JSON schema
+
+```json
+{
+  "agent": "gha-reviewer",
+  "mode": "<MODE>",
+  "started_at": "<ISO8601>",
+  "finished_at": "<ISO8601>",
+  "skipped_findings": [
+    {"rule_id": "shellcheck:SC2086", "reason": "variable is internal/static, not untrusted input"}
+  ],
+  "findings": [
+    {
+      "file": ".github/workflows/ci.yml",
+      "line": 22,
+      "end_line": 22,
+      "rule_id": "zizmor:unpinned-uses",
+      "cwe": "CWE-829",
+      "severity": "medium",
+      "issue": "<one-sentence problem statement>",
+      "evidence": "<file:line — quoted YAML snippet>",
+      "fix": "<concrete YAML change>",
+      "question": "<what to ask the PR author — populated only in ref mode>"
+    }
+  ]
+}
+```
+
+## Rules
+
+- Triage aggressively. Raw actionlint/zizmor output is noisy.
+- Quote `file:line` in `evidence` with a short YAML snippet.
+- DO NOT write anything other than the JSON document to OUTPUT.