feat(review): add option to file findings on the PR as comments

Add a post-review option to /review Step 4 that posts selected findings to the
branch's pull request. The user chooses which findings (all, critical+important,
or specific FINDING-NN ids); each is posted as an inline comment anchored to its
file:line via gh/glab, with a single summary comment as fallback when a line is
not on the diff or no PR/CLI is available. Mechanism lives in a new shared
reference (file-findings-on-pr.md), symlinked into the review skill; allowed-tools
now permits gh/glab. Also fix the Step 4 pointer to the renamed
"Act (by id or rule)" consolidation heading.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ryzizub

skills/review/SKILL.md

@@ -4,7 +4,7 @@ user-invocable: true
 description: Runs quality review agents on demand — reviews code against VGV standards for architecture, tests, and simplicity, then writes one consolidated, numbered report.
 when_to_use: Use when user says "review this code", "review my code", "code review", "review", "check this code", or "review before merging".
 argument-hint: "[path/to/files/or/directories (optional)]"
-allowed-tools: Bash(*/scripts/detect-review-scope.sh)
+allowed-tools: Bash(*/scripts/detect-review-scope.sh) Bash(gh *) Bash(glab *)
 effort: high
 compatibility: Designed for Claude Code (or similar products with agent support)
 ---
@@ -103,6 +103,9 @@ present post-review options (the ids and rules follow the consolidation procedur
 - **Fix critical + important**: same, plus Important findings.
 - **Fix specific findings**: accept ids from the user (e.g. "FINDING-01, FINDING-04"), or a
   rule id to act on a whole class (e.g. "fix every `tests/missing-test-file`").
+- **File findings on the PR as comments**: post selected findings to the branch's pull
+  request, following [file findings on the PR](references/file-findings-on-pr.md) — it asks
+  which findings to include and posts them as inline comments (with a summary fallback).
 - **Keep report and exit**: the report stays at `docs/code-review/<slug>/` for manual review.
 
 **After fixing (if chosen):** re-run linter + test runner (no agent re-run), then present a

skills/review/references/file-findings-on-pr.md

@@ -0,0 +1 @@
+../../shared/references/file-findings-on-pr.md

skills/shared/references/file-findings-on-pr.md

@@ -0,0 +1,79 @@
+# File Findings on the PR
+
+Post selected review findings to the branch's pull request as comments. Findings keep the
+`FINDING-NN` ids and `<category>/<rule>` from the [consolidation procedure](review-consolidation.md),
+so a PR comment maps back to the consolidated report unambiguously.
+
+Outward-facing action: only post after the user has selected findings in Step 1 below. Never
+post without an explicit selection.
+
+## Step 1 — Choose which findings
+
+Use **AskUserQuestion**: "Which findings should I file on the PR?"
+
+- **All** — every finding in the report.
+- **Critical + Important** — skip Suggestions.
+- **Pick specific** — present the findings as one or more multi-select lists (batches of up to
+  four, by `FINDING-NN` id + title) and post only the checked ones.
+
+If the user picks none, stop without posting.
+
+## Step 2 — Detect the platform and PR
+
+Run in parallel:
+
+```bash
+gh --version 2>/dev/null
+glab --version 2>/dev/null
+```
+
+Store the first available as `PR_CLI` (`gh`, `glab`, or `none`). Then find the PR for the
+current branch:
+
+| `PR_CLI` | Command |
+| -------- | ------- |
+| `gh` | `gh pr view --json number,url,headRefOid` |
+| `glab` | `glab mr view` |
+| `none` | No CLI — go to the fallback in Step 4. |
+
+If no PR exists for the branch, tell the user and offer the fallback (print the comments as
+markdown to paste manually). Do not create a PR from here.
+
+## Step 3 — Post the comments
+
+Prefer **inline** comments anchored to each finding's `file:line`. Comment out of these fields:
+
+```markdown
+**FINDING-03 · 🟡 Important · `vgv/force-unwrap`**
+
+Why: <why line>
+Fix: <fix line>
+```
+
+### gh (GitHub)
+
+Resolve `OWNER_REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)`,
+`PR=$(gh pr view --json number -q .number)`, `SHA=$(gh pr view --json headRefOid -q .headRefOid)`.
+For each finding whose `location` is `file:line` and that line is part of the PR diff:
+
+```bash
+gh api "repos/$OWNER_REPO/pulls/$PR/comments" \
+  -f body="$COMMENT" -f commit_id="$SHA" -f path="$FILE" -F line=$LINE -f side=RIGHT
+```
+
+### glab (GitLab)
+
+Post each finding as a note on the MR: `glab mr note <id> -m "$COMMENT"` (include the
+`file:line` in the comment text, since inline positions need the diff SHAs).
+
+### Fallback (no line on the diff, `PR_CLI=none`, or no PR)
+
+Collect the leftover findings into **one** summary comment and post it once
+(`gh pr comment --body-file <file>` / `glab mr note -m ...`), or print it for manual paste
+when there is no CLI/PR. Group by severity; keep the ids.
+
+## Step 4 — Report
+
+Tell the user how many comments were posted, how many fell back to the summary, and the PR
+URL. If any `gh api` call failed (e.g. the line was not in the diff), report which findings
+and include them in the summary comment rather than dropping them.