Eliminate command substitutions from skills and add permission audit

[sebastientaggart]

Eliminate $() command substitutions from skill shell commands that trigger agent permission prompts, and add a permission audit phase to /setup so agents can detect missing allow rules upfront.

Changes:

• Replace cd "$(git rev-parse --show-toplevel)" in submit-for-review with a two-step pattern (get root, then cd to it) — removes the $() that Claude Code flags
• Add permissions.yaml — hand-maintained manifest of shell command prefixes used across all skills
• Add Phase 2 (permission audit) to /setup — reads the manifest, checks the agent's config, suggests missing allow rules. Advisory only.
• Add validate_permissions() to sync.py --validate — catches drift between skills and the manifest
• Add Bash(cd:*) to docs and example settings; normalize allow/deny rules to colon format

Issue #145

[sebastientaggart]

Review Summary

Verdict: APPROVE

Findings

• [WARNING] validate_permissions() only scans ```bash fenced code blocks (re.compile(r'```bash\n(.*?)```')) but several skills use plain ``` fences for their shell commands. In particular, qa.md (9 plain blocks with gh), review.md (1 plain block with gh), and submit-for-review.md (17 plain blocks with git, cd) will not be checked. The validator will silently pass even if those commands are removed from permissions.yaml. Consider matching both ```bash and plain ``` blocks, or at least documenting this limitation. (sync.py line 383)

• [NOTE] validate_permissions is called with all_skill_files (line 497 in the diff) regardless of whether the user passed --skills to limit the scope. This is intentional for correctness (permissions are global), but it differs from how validate_placeholders respects the --skills filter. Worth a comment if intentional.