ci: add automated skill review for SKILL.md pull requests

[popey]

Hullo! Thanks for merging the skill improvements earlier. This is a follow-up that adds a lightweight GitHub Action to automatically review any SKILL.md files when they're changed in a PR, using tessl skill review.

• Triggers only on PRs that touch **/SKILL.md
• Posts review results as a PR comment
• Minimal permissions: pull-requests: write and contents: read

This way you and your contributors get an instant quality signal on skill changes before manual review — no signup or tokens needed.

[shreyas-lyzr]

Apologies for the slow review — this should not have sat for over a month.

Direction is good — automated linting on **/SKILL.md is a pattern we want. Two changes before merge:

1. Pin the third-party action to a SHA, not @main.

```yaml

• uses: tesslio/skill-review@main # current

• uses: tesslio/skill-review@ # please change
  ```

@main means the action's behavior on our PRs can change silently any time tesslio/skill-review ships. For an action with pull-requests: write permission, that's a supply-chain concern — a compromised or even just well-intentioned-but-buggy update could post bad comments on contributor PRs. SHA pinning is the conventional fix; Dependabot can update the SHA later, with review.

2. Brief docs entry in CONTRIBUTING.md.

A line under "What to expect when you submit a SKILL.md PR" explaining: this workflow runs, here's what it does, here's how to disable for in-progress PRs ([skip skill-review] in title? draft PR? — your call). Otherwise contributors get a surprise comment from a bot they didn't know about.

Once those two are in, this is a clean merge. Apologies again for the wait.