Add git-workflow plugin with /ship and /pr:review commands (#10)

* Add git-workflow plugin with /ship and /pr:review commands

Standalone git workflow commands that work independently of the EARS
ticket lifecycle. /ship reviews changes, commits, pushes, and
optionally creates a PR with user confirmation. /pr:review conducts
aggressive analysis on any PR by number/URL or auto-detect and posts
findings as a comment (never approves or merges). Both commands are
optionally ticket-aware when context exists.

* Fix 3 CodeRabbit issues from PR review

- ship/SKILL.md: Add Edit, Write to allowed-tools so Phase 5 "Fix
  Selected Items" can actually modify files
- pr-review/SKILL.md: Fix broken grep invocation where glob patterns
  after -- were treated as filenames instead of filtering stdin
- README.md: Add `text` language tag to 3 unlabelled fenced code blocks
  (markdownlint MD040)

---------

Co-authored-by: AnExiledDev <AnExiledDev@users.noreply.github.com>

Author: AnExiledDev

.devcontainer/CHANGELOG.md

@@ -13,6 +13,10 @@
 #### Claude Code Installation
 - **Post-start onboarding hook** (`99-claude-onboarding.sh`) — ensures `hasCompletedOnboarding: true` in `.claude.json` when token auth is configured; catches overwrites from Claude Code CLI/extension that race with `postStartCommand`
 
+#### Git Workflow Plugin
+- **`/ship`** — Combined commit/push/PR command with full code review, commit message approval, and AskUserQuestion confirmation before PR creation; optionally links to tickets if context exists
+- **`/pr:review`** — Review any PR by number/URL or auto-detect from current branch; posts findings as PR comment with severity ratings; never approves or merges
+
 ### Changed
 
 #### Claude Code Installation

.devcontainer/CLAUDE.md

@@ -89,6 +89,7 @@ Declared in `settings.json` under `enabledPlugins`, auto-activated on start:
 - **protected-files-guard** — Blocks edits to secrets/lock files
 - **codeforge-lsp** — LSP for Python + TypeScript/JavaScript
 - **ticket-workflow** — EARS ticket workflow + auto-linking
+- **git-workflow** — Standalone ship (commit/push/PR) + PR review
 - **notify-hook** — Desktop notifications on completion
 - **frontend-design** (Anthropic official) — UI/frontend design skill
 - **prompt-snippets** — Quick behavioral mode switches via /ps command

.devcontainer/config/defaults/settings.json

@@ -65,7 +65,8 @@
 		"session-context@devs-marketplace": true,
 		"auto-code-quality@devs-marketplace": true,
 		"workspace-scope-guard@devs-marketplace": true,
-		"prompt-snippets@devs-marketplace": true
+		"prompt-snippets@devs-marketplace": true,
+		"git-workflow@devs-marketplace": true
 	},
 	"autoUpdatesChannel": "latest"
 }

.devcontainer/plugins/devs-marketplace/.claude-plugin/marketplace.json

@@ -105,6 +105,14 @@
 			"source": "./plugins/prompt-snippets",
 			"category": "productivity",
 			"keywords": ["snippets", "prompts", "modes", "shortcuts"]
+		},
+		{
+			"name": "git-workflow",
+			"description": "Standalone git workflow: ship (commit/push/PR) and PR review",
+			"version": "1.0.0",
+			"source": "./plugins/git-workflow",
+			"category": "workflow",
+			"keywords": ["git", "commit", "push", "pr", "review", "ship"]
 		}
 	]
 }

.devcontainer/plugins/devs-marketplace/plugins/git-workflow/.claude-plugin/plugin.json

@@ -0,0 +1,7 @@
+{
+  "name": "git-workflow",
+  "description": "Standalone git workflow: review, commit, push, PR creation, and PR review",
+  "author": {
+    "name": "AnExiledDev"
+  }
+}

.devcontainer/plugins/devs-marketplace/plugins/git-workflow/README.md

@@ -0,0 +1,125 @@
+# git-workflow
+
+Claude Code plugin that provides standalone git workflow commands. Not tied to the EARS ticket lifecycle — works independently, but optionally links to tickets when context exists.
+
+## What It Does
+
+Provides two slash commands for shipping code and reviewing pull requests.
+
+### Slash Commands
+
+| Command | Description |
+|---------|-------------|
+| `/ship` | Review all changes, commit with a detailed message, push, and optionally create a PR |
+| `/pr:review` | Review an existing PR by number/URL or auto-detect from current branch (never merges) |
+
+## How It Works
+
+### `/ship` Workflow
+
+```text
+/ship [optional commit message hint]
+  │
+  └─→ Gather context (git status, diff, branch, project rules)
+       │
+       └─→ Full review (security, rules, quality, architecture, tests)
+            │
+            └─→ Present findings → User decisions (fix/issue/ignore)
+                 │
+                 └─→ Draft commit message → User approval
+                      │
+                      └─→ Commit + Push
+                           │
+                           └─→ AskUserQuestion: "Create a PR?"
+                                │
+                                ├─→ Yes: Create PR (+ link ticket if context exists)
+                                └─→ No: Done
+```
+
+### `/pr:review` Workflow
+
+```text
+/pr:review [PR number, URL, or omit for auto-detect]
+  │
+  └─→ Identify target PR (argument, auto-detect, or ask)
+       │
+       └─→ Fetch PR details + diff + changed files
+            │
+            └─→ Aggressive analysis (attack surface, threats, deps, rules, architecture, quality, tests, breaking changes)
+                 │
+                 └─→ Present findings → User decisions (note/issue/ignore)
+                      │
+                      └─→ Post review comment (NEVER approve/merge)
+```
+
+### Ticket Awareness
+
+Both commands are **optionally ticket-aware**:
+- If a ticket number exists in the session context (from a prior `/ticket:work` call), it is linked in commit messages, PRs, and issue comments
+- If reviewing a PR that references a ticket in its body (`Closes #N`, `Refs #N`), requirements are verified against the diff
+- Neither command prompts for a ticket — they work fully standalone
+
+### Review Depth
+
+| Command | Review Depth | Purpose |
+|---------|-------------|---------|
+| `/ship` | Full (same as `/ticket:review-commit`) | Pre-commit gate — catches issues before they enter history |
+| `/pr:review` | Aggressive (same as `/ticket:create-pr`) | Final gate — deep security, threat modeling, and architecture review |
+
+### Finding Severity Levels
+
+| Level | Meaning |
+|-------|---------|
+| Critical | Active vulnerability, data exposure, auth bypass, breaking production |
+| High | Security weakness, significant bug, major pattern violation |
+| Medium | Code smell, minor vulnerability, missing validation |
+| Low | Style, optimization, minor improvements |
+| Info | Observations, questions, future considerations |
+
+## Installation
+
+### CodeForge DevContainer
+
+Pre-installed and activated automatically — no setup needed.
+
+### From GitHub
+
+Use this plugin in any Claude Code setup:
+
+1. Clone the [CodeForge](https://github.com/AnExiledDev/CodeForge) repository:
+
+   ```bash
+   git clone https://github.com/AnExiledDev/CodeForge.git
+   ```
+
+2. Enable the plugin in your `.claude/settings.json`:
+
+   ```json
+   {
+     "enabledPlugins": {
+       "git-workflow@<clone-path>/.devcontainer/plugins/devs-marketplace": true
+     }
+   }
+   ```
+
+   Replace `<clone-path>` with the absolute path to your CodeForge clone.
+
+## Plugin Structure
+
+```text
+git-workflow/
+├── .claude-plugin/
+│   └── plugin.json          # Plugin metadata
+├── skills/
+│   ├── ship/
+│   │   └── SKILL.md         # /ship command definition
+│   └── pr-review/
+│       └── SKILL.md         # /pr:review command definition
+└── README.md                # This file
+```
+
+## Requirements
+
+- Claude Code with plugin command support
+- [GitHub CLI](https://cli.github.com/) (`gh`) installed and authenticated
+- A GitHub repository as the working context