fix: isolate claude reviewer templates

skills/reviewer-runtime/tests/claude-review-template-guard.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+REPO_ROOT=$(cd "$SCRIPT_DIR/../../.." && pwd)
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+assert_contains() {
+  local file=$1
+  local pattern=$2
+
+  if ! grep -qF -- "$pattern" "$file"; then
+    fail "expected '$pattern' in $file"
+  fi
+}
+
+assert_not_contains() {
+  local file=$1
+  local pattern=$2
+
+  if grep -qF -- "$pattern" "$file"; then
+    fail "did not expect '$pattern' in $file"
+  fi
+}
+
+check_skill_file() {
+  local file=$1
+
+  assert_contains "$file" "claude -p \\"
+  assert_contains "$file" '$(cat /tmp/'
+  assert_contains "$file" "--strict-mcp-config"
+  assert_contains "$file" "--setting-sources user"
+  assert_not_contains "$file" "--allowedTools Read"
+}
+
+check_skill_file "$REPO_ROOT/skills/implement-plan/claude-code/SKILL.md"
+check_skill_file "$REPO_ROOT/skills/implement-plan/codex/SKILL.md"
+check_skill_file "$REPO_ROOT/skills/implement-plan/cursor/SKILL.md"
+check_skill_file "$REPO_ROOT/skills/implement-plan/opencode/SKILL.md"
+check_skill_file "$REPO_ROOT/skills/create-plan/claude-code/SKILL.md"
+check_skill_file "$REPO_ROOT/skills/create-plan/codex/SKILL.md"
+check_skill_file "$REPO_ROOT/skills/create-plan/cursor/SKILL.md"
+check_skill_file "$REPO_ROOT/skills/create-plan/opencode/SKILL.md"
+
+echo "PASS: Claude reviewer templates use isolated settings and avoid Read-tool review prompts"