feat(review): add code review MCP skill with session history injection

Implements the review skill following the same pattern as retrospective/tdd.
Validates project_root and files args, prepends session history when a
session_id is provided, and delegates to the executor with Read,Bash tools.
Iron-law discipline prompt enforces CRITICAL/WARNING/SUGGESTION output format.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/skills/review/handlers_test.go

@@ -0,0 +1,61 @@
+// internal/skills/review/handlers_test.go
+package review_test
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	iexec "github.com/mathiasbq/supervisor/internal/exec"
+	"github.com/mathiasbq/supervisor/internal/skills/review"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestReviewToolRegistered(t *testing.T) {
+	sk := review.New(review.Config{SkillPrompt: "review rules"})
+	names := make([]string, 0)
+	for _, tool := range sk.Tools() {
+		names = append(names, tool.Name)
+	}
+	assert.Contains(t, names, "review")
+}
+
+func TestReviewRequiresProjectRoot(t *testing.T) {
+	sk := review.New(review.Config{SkillPrompt: "r"})
+	_, err := sk.Handle(context.Background(), "review", json.RawMessage(`{"files":["main.go"]}`))
+	assert.ErrorContains(t, err, "project_root")
+}
+
+func TestReviewRequiresFiles(t *testing.T) {
+	sk := review.New(review.Config{SkillPrompt: "r"})
+	_, err := sk.Handle(context.Background(), "review", json.RawMessage(`{"project_root":"/tmp"}`))
+	assert.ErrorContains(t, err, "files")
+}
+
+func TestReviewCallsExecutor(t *testing.T) {
+	called := false
+	var capturedTask string
+	fakeFn := func(_ context.Context, req iexec.Request) (iexec.Result, error) {
+		called = true
+		capturedTask = req.TaskPrompt
+		return iexec.Result{
+			Status: "pass", Phase: "review", Skill: "review",
+			Verified: true, ModelUsed: "self", Message: "2 warnings found",
+		}, nil
+	}
+
+	sk := review.New(review.Config{SkillPrompt: "review rules", ExecutorFn: fakeFn, SessionsDir: t.TempDir()})
+	out, err := sk.Handle(context.Background(), "review", json.RawMessage(
+		`{"project_root":"/tmp/proj","files":["internal/foo/foo.go"],"context":"PR: add Foo helper"}`,
+	))
+	require.NoError(t, err)
+	assert.True(t, called)
+	assert.Contains(t, capturedTask, "internal/foo/foo.go")
+	assert.Contains(t, capturedTask, "PR: add Foo helper")
+
+	var result iexec.Result
+	require.NoError(t, json.Unmarshal(out, &result))
+	assert.Equal(t, "pass", result.Status)
+	assert.Equal(t, "review", result.Phase)
+}