feat: add review skill + /altimate-code:review slash command

[sahrizvi]

Summary

Surfaces altimate-code's dbt/SQL PR reviewer via the plugin. The reviewer ships in the altimate-code CLI; this PR exposes it inside Claude Code so users can invoke it from their session.

Two invocation paths, both empirically verified:

• Natural language — "review my dbt changes" auto-fires the review SKILL via description matching. Verified: the model reads the SKILL body, invokes altimate-code review, and presents the signed verdict verbatim.
• Explicit slash command — /altimate-code:review dispatches the command body deterministically. Recommended for scripting / CI where natural-language phrasing shouldn't decide correctness.

Anti-fabrication guardrails in both bodies:

• Do not fall back to native git diff / Read as a "review" — those cannot check equivalence, lineage, or PII.
• Do not fabricate a verdict envelope; if the CLI fails, tell the user and stop.
• Never use --post interactively (writes to a real GitHub PR).
• Never use --mode gate interactively (exits non-zero).

The underlying reviewer agent in altimate-code denies edit/write tools; bash prompts for approval. Read-only by contract.

Test plan

• Step-zero: altimate-code review on a scratch dbt project with planted anti-patterns produces a real signed verdict envelope catching both planted bugs.
• Natural-language prompt ("review my dbt changes") auto-fires the SKILL and produces the same verdict verbatim, no fabrication.
• Slash command /altimate-code:review dispatches the command body and produces the same verdict.
• Renamed skills/altimate-code-review/ → skills/review/ and commands/altimate-review.md → commands/review.md for cleaner altimate-code:review namespace.
• Interactive TUI test — the SKILL description match should trigger the same behavior when the user types a review-shaped prompt in claude interactive mode.

Notes

• Naming: the skill and command both live under the altimate-code plugin, so the fully-qualified invocation is /altimate-code:review. The redundancy of "altimate-code" appearing twice is avoided.
• --bare mode disables plugin skill auto-discovery in Claude Code. This is documented and expected; the slash command remains available regardless of --bare.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• plugins/altimate-code/commands/review.md
• plugins/altimate-code/skills/review/SKILL.md

Both files are documentation defining a Claude Code plugin skill and slash command that delegate to the altimate-code review CLI. The bodies include robust anti-fabrication and anti-prompt-injection guardrails (no native git diff/Read fallback as a "review", no fabricated verdict envelopes, no interactive --post/--mode gate, untrusted-output handling) and consistent scope-selection, flag, and failure-mode tables. No security, correctness, or logic issues were found in the changed lines.

Per the custom redundancy/simplification check: the substantive content overlap between the command and skill bodies (workflow, "never do these", useful flags, failure modes) appears intentional — each is a self-contained invocation path per the PR design — and is not flagged as actionable.

---

_{Reviewed by glm-5.2 · Input: 61K · Output: 11.8K · Cached: 56.2K}