docs: add self-contained code review agent skill

[BenCodez]

Summary

Add a single self-contained review skill at .github/skills/code-review/SKILL.md.

• Preserve independent, source-read-only review of the exact PR/commit snapshot, including explicit handling of local overlays, stale inputs, incomplete history, and connector-only access.
• Inline correctness, public API compatibility, platform/class-loading, concurrency, persistence, security, resource-lifecycle, and test-review checklists tailored to SimpleAPI.
• Use the repository's verified JDK 21 / mvn -B -f SimpleAPI/pom.xml package CI setup as the local validation example, with instructions to recheck current configuration.
• Require concrete P0-P3 findings with precise changed-line locations; distinguish a clean result from an incomplete review or unavailable validation.
• Keep fixes and publishing in the coordinating workflow, with fresh review after changes and bounded review rounds.

Scope

Exactly one added file: .github/skills/code-review/SKILL.md (263 lines).

No helper scripts, reference files, agent profiles, installers, workflows, application code, model/provider settings, or other repositories are changed. The file has no companion-file dependencies and does not promise that every agent host automatically discovers this location.

Existing open PRs and review-named branches were checked before creating this focused branch from main at 23a5665a86087f4bb459202ab16182c1767a7e6c.

Validation

• PASS: 15 local static checks covering YAML frontmatter, name/directory consistency, metadata limits, UTF-8/LF/final newline, whitespace, balanced Markdown fences, absence of missing companion-file references and private endpoints, the verified CI command, single-file scope, and shell-example syntax.
• PASS: git diff --cached --check in a disposable local Git fixture containing only the proposed file; this is a Markdown/diff check, not a full repository build.
• PASS: GitHub comparison against the pinned base shows exactly one commit and only the requested file added. Uploaded blob SHA 061c1b33961f2699c52325e070cd2b6264bfe5cd matches the locally validated bytes.
• NOT RUN: Maven tests/JAR build. Maven is unavailable in this environment, and the attempted direct repository clone failed DNS resolution. GitHub connector access was available for reading and publishing the change.
• NOT RUN: A separate fresh Codex reviewer or live agent-discovery test. The skill received same-context inspection and static validation only.

Kept as a draft; no clean independent-review or successful build claim is made, and no external review was manually requested.

AI disclosure: This pull request was prepared with assistance from ChatGPT.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T23:46:42.637863Z	8f07ec6	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-05T23:47:10.890215Z	8f07ec6	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.