feat(pr-review-toolkit): add specialists, improve signals, optimize collection

- Add security, API-compat, and concurrency specialist reviewers
- Upgrade signal detection with diff-content scanning alongside
  path-based heuristics for more reliable specialist triggering
- Move thread data and overlap classification out of specialists
  into synthesis only, removing postability from FINDING_SCHEMA
- Parallelize thread and file collection for faster wall-clock time
- Increase file page size from 10 to 30 to reduce collection agents
- Trim redundant output format sections from specialist prompts
  while preserving all substantive analytical guidance
- Add ExitPlanMode to SKILL.md to avoid permission prompts
- Bump version to 1.10.0

Assisted-by: Claude:claude-opus-4-6

Author: cblecker

pr-review-toolkit/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pr-review-toolkit",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "Comprehensive PR review board using shared workflow context",
   "author": {
     "name": "cblecker",

pr-review-toolkit/README.md

@@ -95,6 +95,9 @@ repository files and use available read-only MCP tools to verify findings.
 | pr-test-analyzer | Functional code that should have corresponding tests | Analyzes test coverage completeness |
 | comment-analyzer | Changes add or modify comments, docstrings, or docs | Checks comment accuracy and maintainability |
 | type-design-analyzer | Changes introduce or modify type definitions in typed languages | Evaluates type design and invariant quality |
+| security-reviewer | Changes touch auth, crypto, tokens, credentials, or security-related code | Reviews for security vulnerabilities and unsafe patterns |
+| api-compat-reviewer | Changes touch public APIs, exports, or client-facing interfaces | Checks API compatibility and breaking changes |
+| concurrency-reviewer | Changes touch mutexes, locks, channels, goroutines, or parallel code | Reviews concurrency patterns for races and deadlocks |
 
 Agent selection is liberal: when in doubt, the agent runs. All agents execute in
 parallel within a single workflow from the collected PR manifest and thread

pr-review-toolkit/skills/review-pr/SKILL.md

@@ -6,6 +6,7 @@ disable-model-invocation: true
 arguments: [pr-url]
 argument-hint: <github-pr-url>
 allowed-tools:
+  - ExitPlanMode
   - Workflow
   - AskUserQuestion
   - Bash(git fetch origin refs/pull/*/merge)
@@ -45,6 +46,11 @@ The workflow and its agents are read-only — they must not call GitHub write to
 GitHub write tools may be used only after an exact preview and explicit final
 posting approval from the user.
 
+## Exit Plan Mode
+
+If plan mode is active, call `ExitPlanMode` now before proceeding. The workflow
+and its tool calls require manual mode to avoid unwanted permission prompts.
+
 ## Parse PR URL
 
 Parse `$pr-url` to extract owner, repo, and PR number from: