examples: align code-review fixtures + detectors to official scenarios

The issue's deliverables require 8 sample diffs covering specific
scenarios and rule coverage across all 6 categories. Rework fixtures to:
clean, security, async_resource_leak, db_lifecycle, missing_tests,
duplicate_finding, sandbox_failure, secret_redaction.

Add two detectors that bandit/ruff don't provide:
db_lifecycle: a DB connection/cursor opened without with and never
closed (content heuristic, mirrored in the sandbox run_checks.py).
missing_tests: source changed with no corresponding test change
(diff-level; added in the engine for every runtime).
Enable ruff's flake8-bandit (S) rules so os.system is flagged by both
bandit (B605) and ruff (S605), giving a genuine duplicate the dedup
stage collapses. Suppress assert-used (B101/S101) noise.

selftest now scores the 8 official-scenario fixtures (100%/0% on the
proxy set); adds scenario tests for db_lifecycle, missing_tests,
duplicate collapse, sandbox-failure, and all-6-categories.

Updates #92

RELEASE NOTES: NONE

Author: Acture

examples/skills_code_review_agent/fixtures/diffs/0001_insecure.diff

@@ -3,9 +3,10 @@ new file mode 100644
 index 0000000..1111111
 --- /dev/null
 +++ b/worker.py
-@@ -0,0 +1,5 @@
+@@ -0,0 +1,6 @@
 +import time
 +
-+async def handler():
++async def handler(path):
 +    time.sleep(1)
-+    return "ok"
++    f = open(path)
++    return f.read()

examples/skills_code_review_agent/fixtures/diffs/0004_resource_leak.diff

@@ -0,0 +1,18 @@
+diff --git a/greeting.py b/greeting.py
+new file mode 100644
+index 0000000..1111111
+--- /dev/null
++++ b/greeting.py
+@@ -0,0 +1,2 @@
++def greet(name):
++    return f"Hello, {name}!"
+diff --git a/tests/test_greeting.py b/tests/test_greeting.py
+new file mode 100644
+index 0000000..2222222
+--- /dev/null
++++ b/tests/test_greeting.py
+@@ -0,0 +1,4 @@
++from greeting import greet
++
++def test_greet():
++    assert greet("x") == "Hello, x!"

examples/skills_code_review_agent/fixtures/diffs/0005_clean.diff

@@ -0,0 +1,12 @@
+diff --git a/db.py b/db.py
+new file mode 100644
+index 0000000..1111111
+--- /dev/null
++++ b/db.py
+@@ -0,0 +1,6 @@
++import sqlite3
++
++def load(path):
++    conn = sqlite3.connect(path)
++    cur = conn.cursor()
++    return cur.execute("select 1").fetchall()

examples/skills_code_review_agent/fixtures/diffs/0006_eval.diff

@@ -0,0 +1,10 @@
+diff --git a/dup.py b/dup.py
+new file mode 100644
+index 0000000..1111111
+--- /dev/null
++++ b/dup.py
+@@ -0,0 +1,4 @@
++import os
++
++def deploy(target):
++    os.system("scp build " + target)

examples/skills_code_review_agent/fixtures/diffs/0007_yaml_load.diff

@@ -0,0 +1,11 @@
+diff --git a/feature.py b/feature.py
+new file mode 100644
+index 0000000..1111111
+--- /dev/null
++++ b/feature.py
+@@ -0,0 +1,5 @@
++def slugify(text):
++    return text.strip().lower().replace(" ", "-")
++
++def titlecase(text):
++    return " ".join(w.capitalize() for w in text.split())