chore: add code-review skill and strengthen existing skills

[akroshg]

Summary

Create a dedicated code-review skill and strengthen three existing skills (handler-perf, FFI, PR) based on findings from a full-project audit that produced 63 issues across all 12 Rust crates and 2 TypeScript packages.

The existing skills had a 30% catch rate — these changes close the gaps so the same classes of issues are flagged before PRs are opened.

Changes

New: .github/skills/code-review/SKILL.md

10-section framework code review checklist:

1. Cross-layer contract parity — encoding, matching, spec-vs-code, binding surface, coercion rules, literal grammar, fallback contracts
2. Determinism — HashMap iteration, tie-breaking, reproducibility
3. Concurrency & race safety — lock scope, snapshots, catch_unwind on FFI, WASM panic hooks, callback error propagation, file watcher recovery, cache write races, Node event loop blocking
4. Allocation & clone discipline — 17 Rust + 4 TS anti-patterns with fixes
5. Data structure selection — access-pattern-to-structure mapping
6. API surface & deduplication — duplicate logic, caching, public surface
7. Type safety & correctness idioms — #[must_use], silent fallbacks, error precision, byte/char confusion, numeric precision, build-time validation, UTF-8 safety
8. Style & documentation — unused deps, placeholder APIs, tests-that-lock-in-bugs
9. Server runtime & discovery — HTTP semantics, cache invalidation, symlinks, file-size guardrails, HMR injection
10. Protocol & schema hygiene — versioning, backward compatibility

Updated: .github/skills/handler-perf/SKILL.md

Added 5 rules from handler audit:

• No String::from(ch) in escape loops — use encode_utf8
• No string clones for read-only escaping — use as_str()
• No per-request route template re-parsing — pre-parse at load time
• No format! in hex parsing — direct arithmetic
• No silent unwrap_or defaults — propagate errors

Updated: .github/skills/ffi/SKILL.md

Expanded panic safety rules:

• Explicit catch_unwind requirement on all FFI function bodies
• No unwrap()/expect() in any FFI code path (including helpers)

Updated: .github/skills/pr/SKILL.md

• Removed misplaced 60-line engineering checklist (wrong home for it)
• Added cross-reference to the new code-review skill

Updated: .github/copilot-instructions.md

• Registered code-review skill in the skills directory listing