feat(review-fix-loop): package and document the standalone skill for discovery

[shaug]

Summary

Packages, documents, and exposes the standalone review-fix-loop skill
(already fully implemented by epic #95's prior children #96-#101) through this
repository's established discovery and distribution surfaces:

• Lists skills/review-fix-loop in the README's "Current reusable agent
  skills" section (its local_commit/update_pr policies and the tracked
  Migrate implement-ticket repository review remediation to review-fix-loop #103/Migrate babysit-pr repository review remediation to review-fix-loop #104/Evaluate and migrate carve-changesets remediation to review-fix-loop #105 caller-migration follow-ups), corrects the "eight skills"
  installation count to nine, and wires its existing
  just test-review-fix-loop/just eval-review-fix-loop targets into the
  Quick Start and evaluation sections.
• Adds review-fix-loop to scripts/validate_plugins.py's REQUIRED_SKILLS
  set, so plugin packaging validation (already run in CI) now fails closed if
  the skill or its agents/openai.yaml ever goes missing from the installed
  plugin — matching every other repository-owned skill.
• Refreshes skills/review-fix-loop/agents/claude-code.md and
  agents/openai.yaml, stale since issue Implement review-fix-loop reviewer isolation and complete-review orchestration #98 (reviewer orchestration): they
  described only document validation and one review pass, predating the
  local_commit/update_pr workflows issues Deliver and evaluate standalone review-fix-loop local_commit #99-Build deterministic and result-blind review-fix-loop evaluation coverage #101 actually delivered.
• Adds a "Publication policy and retained commits" section directly to
  SKILL.md (the first document a caller reads) stating plainly that both
  workflows keep fixes local until convergence, that update_pr publishes
  exactly once, and that every non-converged terminal result reports its
  retained unpushed commits via unpushed_commits/operator_action — this
  was previously documented only in references/CONTRACT.md and
  references/local-commit.md/update-pr.md.
• Records the change in CHANGELOG.md, including backfilling the SHA a prior
  entry was missing (an outstanding gap from PR feat(review-fix-loop): add the cross-cutting, result-blind evaluation corpus #113's own changelog step,
  caught by this PR's own review-code-change pass).

Why

Issue #102 is the final child of epic #95. Everything else review-fix-loop
needed (contracts, local execution, reviewer orchestration, local_commit,
update_pr, evaluation corpus) already merged; this ticket's job was closing
the remaining packaging/discovery/documentation gaps per
design/review-fix-loop.md's rollout step 6, following the same conventions
already established for sibling skills (review-code-change,
implement-ticket, carve-changesets) rather than inventing new packaging
patterns.

Acceptance criteria

• A clean installation discovers and invokes the skill by name — verified
  with a fresh git clone into a scratch directory at this PR's exact head,
  then skills-ref validate skills/review-fix-loop, skills-ref to-prompt skills/*/ (shows review-fix-loop by name in the <available_skills>
  listing), and python3 scripts/validate_plugins.py (now requires it).
• Documentation makes fresh read-only subagents the default and the
  in-agent path an explicit override — SKILL.md "Run a complete review",
  references/reviewer-orchestration.md, agents/claude-code.md.
• Documentation clearly states that fixes remain unpushed until
  convergence and warns about retained unpushed commits on non-converged
  exits — new SKILL.md "Publication policy and retained commits" section.
• Both execution modes have runnable examples and terminal-result
  examples — pre-existing references/examples/*.json,
  scripts/tests/test_local_commit.py/test_update_pr.py,
  scripts/evals/runner.py --scenario <id>; confirmed still passing.
• Missing dependencies or unsupported host capabilities produce
  actionable, fail-closed errors — pre-existing
  resolve_review_execution_mode -> blocked/missing_capability,
  update_pr.py's missing_authority/remote_advanced/publication_failed;
  confirmed unit-tested.
• Packaging and discovery validation runs in CI —
  .github/workflows/ci.yml's existing "Validate skills (agentskills)" and
  "Validate plugin packaging" steps already run generically over skills/*;
  the latter now enforces review-fix-loop's presence.

Validation

• just format — pass
• just lint — pass (9/9 skills valid via skills-ref validate, plugin
  packaging valid)
• just test — pass (every skill's scripts/tests suite green, including
  273 tests under skills/review-fix-loop/scripts/tests and 318 under
  review-suite/scripts/tests)
• Fresh-clone smoke test at this PR's exact head: skills-ref validate,
  skills-ref to-prompt, python3 scripts/validate_plugins.py, and
  python3 skills/review-fix-loop/scripts/validate.py terminal-result <example> all pass
• Two review-code-change passes in fresh, read-only subagents: the first
  found one strong-recommendation correctness finding (a missing CHANGELOG
  SHA backfill required by AGENTS.md); fixed, re-validated, and the
  follow-up pass returned clean across all three lenses
  (solution-simplicity, correctness, code-simplicity)

Fixes #102