feat(engineering): add interactive PR review skill

[christso]

Summary

Reviewers can now turn a Compound Engineering structured code review into a reusable local workspace with business context, concrete failure scenarios, exact reviewed-commit links, and local discussion. This replaces one-off static review pages while leaving scope, severity, validation, and deduplication with ce-code-review.

This is a draft for maintainer alignment before merge.

Design decisions

• Generated review data and comments live outside the repository in a workspace partitioned by repository and PR.
• A separate scenario sidecar adds concrete “what happens” and “expected” context without modifying the CE review artifact.
• User-authorized private specifications are reduced to labeled primer fields before rendering.
• The server binds to loopback by default. Wider exposure requires an explicit option and warning.
• Comments remain local. Assistant replies use a local API; the skill has no GitHub-comment posting path.

Safety

The renderer escapes untrusted values, validates paths and identifiers, pins source links to the reviewed commit, rejects cross-origin writes, and bounds request bodies while streaming. Comment updates use atomic writes, and the server does not expose arbitrary filesystem paths.

Validation

• bun test tests/unit/plugins/pr-interactive-review.test.ts — 9 passed, 59 assertions
• bunx tsc -p plugins/engineering/skills/pr-interactive-review/scripts/tsconfig.json — passed
• Biome check for the runtime and test — passed
• claude plugin validate plugins/engineering --strict — passed
• Browser smoke test with a fictional fixture — business primer ordering, scenario rendering, severity filtering, exact source links, local comments, assistant replies, and 390 px responsive containment passed
• Public-content audit — no private project references, absolute home paths, or credential patterns found