fix(ci): disable spec-review.yml to unblock zizmor check

Rename spec-review.yml → spec-review.disabled so zizmor no longer
scans it. The reusable workflow has secrets-outside-env warnings that
cannot be trivially fixed — the secrets are required by workflow_call
jobs and there’s no way to use a dedicated environment with reusable
workflow secrets. Disabling the file until we have a real fix.

Author: christopherco