chore: retire the local pr-review skill now that Pullfrog reviews every PR

[thomasluizon]

What this does

Paired with thomasluizon/orbit-ui-mobile#716, which makes Pullfrog the only pull request reviewer and deletes the local review machinery. This is the api half.

Order does not matter here. Neither PR changes a DTO, so the deploy-API-first rule does not apply.

Changes

Deleted .claude/skills/pr-review/SKILL.md. It was a 26 line pointer to the orbit-ui-mobile skill that #716 deletes, so it becomes a dangling reference.

Corrected a false claim in CLAUDE.md. It said "No review status check exists in either repository". One does now: pullfrog-approval, a required status check on main in both code repositories, pinned to app id 1768019. Verified live with gh api repos/thomasluizon/orbit-api/branches/main/protection. required_approving_review_count is still 0, so that half of the sentence stands and is kept.

contract-aligner and security-reviewer become manual only. Both auto-invoked "during /pr-review", a trigger that stops existing. Pullfrog runs as a service in GitHub Actions and cannot invoke a local Claude Code agent, so no automatic trigger would be honest. They stay available as lenses to /audit-code-quality and /audit-security. .opencode/agents/contract-aligner.md carries the identical edit, because the two are declared lockstep copies.

second-opinion loses a claim that was already false. It said /pr-review had a "Phase 6" that auto-fired it on each surviving Critical or High finding. /pr-review had no Phase 6 and never named second-opinion, so the claim was wrong before this change too. It now says plainly that nothing fires it automatically.

Comment cleanup in .gitattributes and tools/check-frontmatter.mjs. Both described the pr-review mirroring contract, and check-frontmatter.mjs also claimed to be vendored from an orbit-ui-mobile file that does not exist. The rules themselves are unchanged; only the prose that had gone false.

.github/workflows/pullfrog.yml loses 3 em dashes from its comments, which the Dash Ban gate rejects.

Verification

Gate	Result
node tools/check-frontmatter.mjs	frontmatter ok: 5 skill and agent files parse
node tools/check-dashes.mjs --check-baseline	clean
node tools/check-root-allowlist.mjs	clean

grep -rn "pr-review" over the whole repository returns nothing. So does the same sweep for chatgpt-codex-connector and codex-only.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[pullfrog]

✅ No new issues found.

Reviewed changes across the local review-skill retirement, surviving agent metadata, repository guidance, and hygiene comments.

• Reviewer retirement: Deletes the now-dangling API pointer while paired orbit-ui-mobile PR #716 removes the canonical local reviewer and rewires readiness around Pullfrog.
• Manual specialist tools: Updates contract-aligner, security-reviewer, and second-opinion descriptions to match their surviving invocation paths.
• Repository guidance: Records Pullfrog as the sole PR reviewer and the required pullfrog-approval context while retaining the zero-approval-count rule.
• Hygiene cleanup: Removes stale mirroring prose and dash-ban-incompatible workflow comments without changing gate behavior.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}