Use gh --body-file - stdin heredoc to preserve Bash(gh:*) permission match

[sebastientaggart]

Replaces --body "$(cat <<'EOF' ...)" and --notes "$(cat <<'EOF' ...)" in skills/submit-for-review.md and skills/deploy.md with --body-file - / --notes-file - piped from a stdin heredoc.

The $(...) form defeats Claude Code's permission matcher — any command containing command substitution cannot match Bash(gh:*), so users got a Yes/No prompt with no "Allow always" option on every PR/issue/release creation. Stdin heredoc redirection is not substitution, so the gh invocation stays pure literal flags and matches cleanly.

Also avoids a temp-file approach (e.g. /tmp/cc_pr_body.md) which still triggers per-path permission prompts in practice.

Issue #82

[sebastientaggart]

Review Summary

Verdict: APPROVE

Findings

No issues found. Code looks correct and follows project conventions.

• [NOTE] The gh issue create example places [--label "..."] between --body-file - and the <<'EOF' heredoc redirect, which is valid bash (the redirect binds to the command regardless of position) but may read as unusual; consider a brief inline note if future readers find it confusing.