feat(review-tutor): add harness adapters

[ElbertePlinio]

Changed

• add the Claude Code Review Tutor plugin and Pickforge marketplace entry
• add the Codex Review Tutor skill
• document Pi, Claude Code, Codex, and shell installation, including the pre-v0.13.0 checkout path
• make the Claude skill pass one validated, single-quoted source argument through Bash and never fetch the returned URL
• add marketplace metadata and set the Claude plugin manifest to v0.12.0

Release note: the Claude plugin manifest version and the npm package version must move together; PR B sets both to v0.12.0.

Tested

• bun run check
• claude plugin validate --strict .claude-plugin/marketplace.json
• claude plugin validate --strict packages/review-tutor/claude-plugin
• isolated temporary Claude local-path marketplace install, list, details, uninstall, and post-uninstall empty list
• isolated Codex skill copy and structural validation

Not tested

• invoking /review-tutor through Claude Code or Codex, because request-spending commands were explicitly excluded
• remote git-subdir installation before the plugin exists on the marketplace's unpinned main source

Risk class: standard

Refs #82

[ElbertePlinio]

Ready for human review at 98ae289 (base #83). Review: P1 shell-injection path in the skill's ! block removed (agent-composed Bash call, single-quoted argv, charset allowlist), README caveat until v0.13.0, marketplace description, plugin version 0.12.0 in lockstep. claude plugin validate --strict passes for plugin and marketplace; local marketplace install/uninstall proof done. Follow-up hardening (CLI-side charset check) lands on #83.

[ElbertePlinio]

Rebased onto #85 at ad434c0; CI green at 1ab82f9 (run 33007073567). No source changes since the review-clean head.