[agents] Teach review workflow validation

[coisa]

Related Issue

Closes #241

Motivation / Context

• PR [ci] Auto-resolve predictable PR conflicts #237 surfaced a workflow-review gap: bot-authored commits pushed with GITHUB_TOKEN need explicit required-check dispatch or mirroring.
• The review skill and review-guardian agent should preserve that premise for future workflow/action changes instead of relying on reviewer memory.

Changes

• Added workflow-action-validation.md to the pull-request review skill references.
• Updated $pull-request-review to require executable validation strategies for workflow, local-action, and packaged-wrapper changes.
• Updated review-guardian responsibilities with the same workflow validation expectations.
• Updated the review request action brief so automatically requested reviews highlight validation evidence, bot-authored commits, and required-check mirroring.
• Added a changelog entry.

Verification

• composer dev-tools
• composer dev-tools code-style -- --fix --json
• composer dev-tools changelog:check
• node --check .github/actions/review/render-request/run.cjs
• Mocked render-request/run.cjs execution and verified generated comment/summary include workflow validation guidance
• git diff --check

Documentation / Generated Output

• README updated
• docs/ updated (packaged skill/agent guidance updated; no Sphinx docs needed)
• Generated or synchronized output reviewed

Changelog

• Added a notable CHANGELOG.md entry

Reviewer Notes

• This intentionally updates the existing review skill/agent rather than introducing a separate skill yet. The new reference is isolated so we can split it later if it grows.

[github-actions]

🚀 Preview is available for this pull request.

• Docs: https://php-fast-forward.github.io/dev-tools/previews/pr-242/
• Coverage: https://php-fast-forward.github.io/dev-tools/previews/pr-242/coverage/
• Metrics: https://php-fast-forward.github.io/dev-tools/previews/pr-242/metrics/