feat(pr-management): with-reviewers: runs model CLIs as adversarial reviewers

[potiuk]

PR 4 of 4, stacked on #1372. This PR's base is feat/adversarial-review-pre-pr, so the diff shows only PR 4. Merge #1371 and #1372 first; this PR then retargets to main. It is the last of the series.

Summary

• pr-management-code-review gains a tool path. with-reviewers:codex,copilot has the agent run the adversarial-review tool over each PR at Step 5. So does a configured adversarial-review.md whose mode is not off. The findings are folded in and attributed per reviewer. with-reviewer:<slash command> and "Review preferences" keep today's propose-and-type flow.
• What the reviewers see. The tool reviews --target pr:<N> from an empty temporary directory, since the skill has no checkout of the PR's head and the maintainer's own checkout must not be readable by other models. A private repository's PR asks before the first run. The session announcement names the reviewers, so the maintainer knows where diffs go.
• Resolution order. It is defined once, in prerequisites.md §2, and SKILL.md, selectors.md and adversarial.md point at it. Prefetched PRs get Step 5 from the parent.
• Plan folded in. The implementation plan becomes the design's As built section and is deleted, per docs/designs/README.md. The design's status is now "Built".

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Documentation (docs/, README.md, CONTRIBUTING.md)

Test plan

• prek run --all-files passes
• For Python packages touched: tools/adversarial-review passes pytest (144 tests). A test now pins code-review's copy of the command, --repo-dir included, to the sandbox exclusion.
• For skill behaviour changes: new eval suite pr-management-code-review/step-2-reviewer-resolution (8 cases). It covers:
  • with-reviewers:, with-reviewer:, and config on-demand / off;
  • no-adversarial;
  • a missing plugin, both with an explicit with-reviewer: and with a config-selected tool path.

RFC-AI-0004 compliance

• HITL: the reviews are advisory, and the maintainer still picks the disposition and confirms every posted review.
• Privacy LLM: reviewers see the public PR's diff, title and body, from an empty directory. A private repository asks first.
• Vendor neutrality: any of the four model CLIs, or any slash-command reviewer.

Linked issues

Stacked on #1372 and #1371; follows #1368.

🤖 Generated with Claude Code