docs: add self-contained code review agent skill

[BenCodez]

Summary

Add the VotingPlugin counterpart to BenCodez/SimpleAPI#74 as one self-contained file: .github/skills/code-review/SKILL.md.

• Independent, source-read-only review of the exact PR/commit snapshot, including explicit local overlays, stale inputs, incomplete history, and connector-only access.
• VotingPlugin-specific checks for vote processing, site resolution/auto-creation, totals/rewards/reset boundaries, proxy/backend delivery, mixed-version peers, and platform scheduling.
• A dedicated Control section aligned with the current root AGENTS.md: voting remains independent of Control availability; typed capabilities/inspections, redaction, managed YAML boundaries, revision/rollback, durable results, retries, and read-only reward simulation remain protected.
• Inline concurrency, persistence, security, packaging, and test-review guidance; concrete P0-P3 findings with precise changed-line locations.
• The verified JDK 21 CI command, mvn -B -f VotingPlugin/pom.xml package, and the existing prohibition on the live-server-copying dev Maven profile.

Scope

Exactly one added file, .github/skills/code-review/SKILL.md (286 lines).

No companion scripts/reference files, agent profiles, installers, workflows, application code, AGENTS.md, model/provider settings, or other repository changes. In particular, this does not change VotingPlugin-Control or the open transport/Control implementation PRs.

Existing open non-Dependabot PRs, review-named branches, root instructions, the .github tree, CI workflow, and relevant POM configuration were inspected before branching from master at ccfd3b8e236b3f3e9dc2bb78c1e05be8ab54ad9f. The base was rechecked before publication.

The skill is self-contained and makes no promise that every agent host automatically discovers this location. Unmerged or unreleased features are not treated as implemented contracts.

Validation

• PASS: 14 local static checks: UTF-8/BOM, LF/final newline, whitespace, frontmatter delimiters, metadata schema/name-directory match, metadata bounds, repository heading/trigger, workflow sections, balanced Markdown fences, absence of companion-file references, correct build example including the dev-profile warning, shell syntax, one-file fixture scope, and git diff --cached --check.
• Shell examples were parsed with bash -n, not executed. Git checks used a disposable fixture containing only the proposed Markdown file, not a full repository clone.
• PASS: GitHub comparison shows one commit and only the requested file added. Uploaded blob ae17668a04fb794e0b8c4640dde8af377b203b11 matches the locally validated bytes.
• NOT RUN: Maven tests/JAR build. Maven is unavailable in this environment, and direct GitHub access from the container failed DNS resolution. Consequently the repository's local full-build requirement has not been satisfied; the PR remains draft rather than claiming readiness.
• NOT RUN: A separate fresh reviewer or live agent-discovery test. Inspection was same-context plus the static checks above.

Kept as a draft. This is not a successful build or independent clean-review claim. No external review was manually requested.

AI disclosure: This pull request was prepared with assistance from ChatGPT.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T00:00:58.974468Z	b13d945	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-06T00:02:36.952989Z	b13d945	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.