review skill update: preflight, REST-first diff, fuse mode

[jmccreight]

Hardening from the skill's first real run (PR #407):

• Preflight step: REST-first diff acquisition via the public GitHub API (follow the EC-USGS -> DOI-USGS 301); gh is optional and its GraphQL paths are SAML-blocked for this org, so gh pr diff does not work.
• Consolidate blocking questions into one poll and forbid proceeding on a documented default for an unanswered question.
• Split the ground rules: the report file is the only permitted write, while read-only verification by execution is encouraged; pass both down to the built-in code-review sub-agents.
• Permit read-only git under /review alongside the REST preference, and note that a diff vs upstream/develop is only as fresh as the last fetch.
• Document fuse mode: a blind second pass plus a self-contained fused report with per-finding provenance and explicit reconciliation.
• Sharpen Layer A from real misses: compare pytest flags in ci_local.sh and not just file lists, verify doc/api autosummary targets exist, and read a skip guard's presence-vs-value logic before calling a collected test a CI failure.

CLAUDE.md: note the second-pass and fused report modes.